PyPI/lightrag-hku CVE-2026-30762: high 7.5

LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass

Action: Upgrade lightrag-hku to 1.4.13 or later.

pip install lightrag-hku==1.4.13

Affected

Fixed versions

Sources

• osv: GHSA-mcww-4hxq-hfr3
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mcww-4hxq-hfr3
• https://github.com/HKUDS/LightRAG

CVE-2026-30762 · published 2026-04-04T06:14:41Z · modified 2026-07-13T16:43:52.932246324Z · JSON