CVE-2026-61736
2 advisories.
PyPI/lightrag-hku CVE-2026-61736: critical 9.3, EPSS 1.42%
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Action: Upgrade lightrag-hku to 1.5.4 or later.
pip install lightrag-hku==1.5.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.4 | - |
Fixed versions
| 1.5.4 |
Sources
- osv: GHSA-6x6h-qqr7-855w
- https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w
- https://nvd.nist.gov/vuln/detail/CVE-2026-61736
- https://github.com/HKUDS/LightRAG/pull/3317
- https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d
- https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d
- https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252
- https://github.com/HKUDS/LightRAG
- https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4
CVE-2026-61736 · published · modified · JSON
PyPI/lightrag-hku CVE-2026-61736: critical 9.3, EPSS 1.42%
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests
Action: Upgrade lightrag-hku to 1.5.4 or later.
pip install lightrag-hku==1.5.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.4 | - |
Fixed versions
| 1.5.4 |
Sources
- osv: PYSEC-2026-3474
- https://github.com/HKUDS/LightRAG/security/advisories/GHSA-6x6h-qqr7-855w
- https://nvd.nist.gov/vuln/detail/CVE-2026-61736
- https://github.com/HKUDS/LightRAG/pull/3317
- https://github.com/HKUDS/LightRAG/commit/09567a4c983f580050db63569dd477122c058c3d
- https://github.com/HKUDS/LightRAG/commit/df68d75f9dc29dd340ffb6794b48f48c4fdc9a2d
- https://github.com/HKUDS/LightRAG/commit/ebba6548639c0f2e8919100eff76b401f1222252
- https://github.com/HKUDS/LightRAG
- https://github.com/HKUDS/LightRAG/releases/tag/v1.5.4
- https://pypi.org/project/lightrag-hku
- https://github.com/advisories/GHSA-6x6h-qqr7-855w
CVE-2026-61736 · published · modified · JSON