CVE-2026-85709: Sensitive Information Exposure in LightRAG API Server

Vulnerability ID: CVE-2026-85709
CVSS Score: 5.3
Published: 2026-09-22

CVE-2026-85709 is a sensitive information exposure vulnerability in HKUDS LightRAG prior to version 1.5.5. The vulnerability allows remote, unauthenticated clients to trigger server-side errors and receive raw Python exception details, including local filesystem paths, database connection strings, credentials, and internal system configurations.

TL;DR

Improper error handling in LightRAG's FastAPI server prior to version 1.5.5 permits unauthenticated network clients to leak highly sensitive infrastructure details, including absolute filesystem paths and database host parameters, by triggering raw exception traces.

Technical Details

• CWE ID: CWE-209
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 5.3 (Medium)
• Exploit Status: No Public Exploits
• Impact: Partial Confidentiality Leak
• CISA KEV Status: Not Listed

Affected Systems

• HKUDS LightRAG
• LightRAG: < 1.5.5 (Fixed in: 1.5.5)

Code Analysis

Commit: dcab315

Implement centralized error sanitization helper in utils_api.py and apply to API routers.

Commit: 4d90a0e

Sanitize validation ValueError exceptions in chunking operations to prevent raw exposures.

Mitigation Strategies

• Upgrade LightRAG to version 1.5.5 or higher.
• Enforce API authentication using the LIGHTRAG_API_KEY environment variable.
• Implement network-level access control lists to block public access to the API port (default 9621).

Remediation Steps:

1. Terminate the active LightRAG API server instance.
2. Upgrade the local package dependency using 'pip install --upgrade lightrag>=1.5.5'.
3. Configure the 'LIGHTRAG_API_KEY' environment variable to mandate authentication across all routes.
4. Restart the API server and verify that failed endpoints output only sanitized correlation IDs.

References

• GitHub Security Advisory GHSA-hrmj-7rvj-4hg8
• LightRAG Pull Request #3422
• LightRAG Release v1.5.5
• Fix Commit: Centralized Sanitization Helper
• Fix Commit: Chunking 422 Sanitization
• NVD CVE-2026-85709 Detail

Read the full report for CVE-2026-85709 on our website for more details including interactive diagrams and full exploit analysis.