VulnSocial

CVE-2026-61736Disclosure

LOWCVSS 9.3 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.4, the server defaults to CORS_ORIGINS=* combined with allow_credentials=True in lightrag/api/lightrag_server.py, causing Starlette CORSMiddleware to effectively whitelist every origin for credentialed cross-origin requests. Any malicious website visited by an authenticated LightRAG user can silently make authenticated API requests, exfiltrating documents and knowledge graph data or performing destructive actions such as deleting the document store. This vulnerability is fixed in 1.5.4.

Back to dashboard
2.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-942

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • Exploit tooling references are present in monitored signal
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-21); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-21: 1Mentions · 2026-09-14: 1Exploit Tool / Code · 2026-09-14: 1Technical Details · 2026-07-21: 1Technical Details · 2026-09-14: 107-2109-14
Signal classification2 categories
Disclosure
150.0%
Exploit
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-211
Disclosure1
2026-09-141
Exploit1
Full discourse2 posts
  • pdnuclei-bot@pdnuclei_bot
    Exploit

    🚨 CVE-2026-61736 - high 🚨 LightRAG <= 1.5.3 - Credentialed CORS Wildcard > LightRAG <= 1.5.4 contains a broken access control vulnerability caused by default CO... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-61736 @pdnuclei #NucleiTemplates #cve

    Post summary

    The tweet announces CVE-2026-61736, a high-severity broken access control vulnerability in LightRAG versions <=1.5.3 due to a default CORS wildcard, and highlights the availability of a Nuclei template for detection/exploitation by linking to a Project Discovery library page and tagging @pdnuclei.

    00000198
    1.3K followersView on X
  • DailyCVE@dailycve
    Disclosure

    🔴 LightRAG, CORS Misconfiguration, #CVE-2026-61736 (Critical) -DC-Jul2026-1113 https://dailycve.com/lightrag-cors-misconfiguration-cve-2026-61736-critical-dc-jul2026-1113/

    Post summary

    The post announces a new critical CORS misconfiguration vulnerability (CVE-2026-61736) affecting LightRAG, but provides no proof of exploit, PoC, or mitigation information.

    0000028
    220 followersView on X

Explore more

Back to dashboard