CVE-2026-85709

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials, and URI-configured backends can disclose connection strings containing credentials depending on the underlying driver error. This issue is fixed in version 1.5.5.

• CWE-209

• https://github.com/HKUDS/LightRAG/commit/4d90a0eb35d40b45f3a9045e308ec126897a3364
• https://github.com/HKUDS/LightRAG/commit/dcab315d7dc1eea682e9b2c4fcb1b06474484c47
• https://github.com/HKUDS/LightRAG/pull/3422
• https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-hrmj-7rvj-4hg8

Published

Sep 22, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85701A vulnerability has been found in ramon-victor freegpt-webui…5.3
• CVE-2026-85702A security vulnerability has been detected in ramon-victor f…7.3
• CVE-2026-85703A flaw has been found in ramon-victor freegpt-webui up to 09…6.5
• CVE-2026-85704A security flaw has been discovered in ramon-victor freegpt-…3.7
• CVE-2026-85705The Location Manager plugin for WordPress is vulnerable to g…7.5
• CVE-2026-85706GitLab has remediated an issue in GitLab CE/EE affecting all…10
• CVE-2026-8571Insufficient policy enforcement in GPU in Google Chrome on A…8.3
• CVE-2026-85715ExifReader is a JavaScript Exif information parser. Prior to…7.5
• CVE-2026-85716The AsyncHttpClient (AHC) library allows Java applications t…3.7
• CVE-2026-85717The AsyncHttpClient (AHC) library allows Java applications t…6.8
• CVE-2026-85718The AsyncHttpClient (AHC) library allows Java applications t…5.9
• CVE-2026-85719The AsyncHttpClient (AHC) library allows Java applications t…7.5