LightRAG Security Update Addresses 5 Vulnerabilities
Tech GuruQuick Answer
LightRAG 1.5.5 is the listed release for these five issues in lightrag-hku: verbose API errors, plaintext-password timing, missing login throttling, native-Markdown image SSRF and stored WebUI script injection. Four advisories name the fix directly; the login advisory has a blank patch field, but the 1.5.5 release notes include its rate-limit change. Inventory the API, frontend and enabled ingestion/authentication paths, then update and test each boundary.
Confirm Scope And Apply The Supported Fix
What to do now: restrict the API and document-ingestion paths to intended users while upgrading the backend and served WebUI. Review plaintext AUTH_ACCOUNTS, login-rate-limit settings and image-download permissions. Keep provider credentials and document data out of diagnostic tickets and use synthetic content for acceptance tests.
Source recheck: October 2, 2026 UTC. The linked project advisories were checked for this revision; deployment applicability and successful remediation still require local evidence. Recheck the supported release before changing production.
Scope And Authority
| Product scope | LightRAG packages and release streams identified in the project advisories |
|---|---|
| Advisory | GHSA-hrmj-7rvj-4hg8 / GHSA-c759-cx9p-mrwq / GHSA-frch-4w6v-q5xx / GHSA-vv3m-f8x4-7377 / GHSA-xpjq-3w4w-w5wr |
| CVEs | CVE-2026-85709, CVE-2026-85725, CVE-2026-85734, CVE-2026-85740, CVE-2026-86062 |
| Authoritative release date | 2026-07-18, 2026-07-20 UTC (project advisory dates, not database ingestion) |
| Authority revision date | 2026-09-04 UTC (project advisory dates, not database ingestion) |
| Affected versions | Four primary reports list versions through 1.5.4 (or before 1.5.5). The login-rate-limit report specifically lists <=1.5.3; its broader later-version applicability is not established by that field. Compare the enabled feature and actual deployed code, not just the package label. |
| Fixed version | lightrag-hku 1.5.5 for the listed fixes, using a supported release containing them. For CVE-2026-85734, the mapping is corroborated by release 1.5.5 and merged PR 3424; its advisory patch field remains blank. |
| CVSS base score | 5.3 / 5.9 / 6.1 / 7.1 / 9.1 (CVSS v3) |
| CVSS severity | Medium to Critical |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Raw API exceptions can expose internal paths or service details. The timing report applies to plaintext passwords in AUTH_ACCOUNTS, not the separate bcrypt path. Native-Markdown image retrieval can bypass address checks through IPv6-transition forms when the host routes them to an internal destination. The stored-XSS report concerns untrusted ingested content rendered in the WebUI. The login fix adds throttling, but its per-process state and configuration mean an upgrade is not proof of effective distributed brute-force protection.
What To Validate Now
- Inventory. Record backend/frontend builds, authentication mode, password storage format, worker count, login-limit configuration, image downloads and outbound routing.
- Establish applicability. Separate the plaintext-password path from bcrypt, and confirm whether native Markdown downloads and relevant IPv6 transition routes exist. Ingestion-derived browser content remains untrusted even when uploaded by an authenticated account.
- Remediate. Apply lightrag-hku 1.5.5 through the supported vendor or project channel, following the current advisory and change-control requirements.
- Validate. In staging with synthetic documents/accounts, verify sanitized answers and errors, rejected unauthorized downloads, effective login throttling and legitimate logins. Confirm that the deployed frontend assets changed with the server release.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
