{"data":{"id":"05556d9c-4841-4236-9268-4633e14e93a5","title":"CVE-2026-85709: LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw…","summary":"LightRAG's API server, before version 1.5.5, returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py and lightrag_server.py. A network client that triggers an error can read server filesystem paths, database host, port, user and database names, language-model provider diagnostics, configuration details and library internals, and with URI-configured backends possibly connection strings containing credentials. The default unauthenticated configuration makes these responses reachable without credentials.","solution":"Fixed in 1.5.5.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85709","publishedAt":"2026-09-22T17:17:27.020Z","cveId":"CVE-2026-85709","cweIds":["CWE-209"],"cvssScore":"5.3","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["lightrag-hku@<= 1.5.4 (fixed: 1.5.5)"],"affectedPackageNames":["lightrag-hku"],"affectedPackageRefs":["pypi:lightrag-hku"],"affectedVendors":[],"affectedVendorsRaw":["LightRAG"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LightRAG API server leaks raw Python exception text in error responses","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00419,"epssCheckedAt":"2026-11-07T12:08:47.893Z","kevDateAdded":null,"advisoryAliases":["GHSA-hrmj-7rvj-4hg8"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:43:21.632Z","patchAvailable":true,"disclosureDate":"2026-09-22T17:17:27.020Z","fixReleasedAt":"2026-07-31T12:08:28.786Z","daysToFix":-53,"fixCheckedAt":"2026-10-29T21:30:20.362Z","capecIds":["CAPEC-54"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"lightrag-hku","fixedVersion":"1.5.5","matchedVersion":"1.5.5","fixReleasedAt":"2026-07-31T12:08:28.786Z","daysToFix":-53,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:20.211Z"}]}}