CVE-2026-85709: LightRAG API server leaks raw Python exception text in error responses

Summary

LightRAG's API server, before version 1.5.5, returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py and lightrag_server.py. A network client that triggers an error can read server filesystem paths, database host, port, user and database names, language-model provider diagnostics, configuration details and library internals, and with URI-configured backends possibly connection strings containing credentials. The default unauthenticated configuration makes these responses reachable without credentials.

Mitigation

Fixed in 1.5.5.

Topics

• Retrieval-augmented generation

Related items

• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
• HighCVE-2026-123974: TorchServe local privilege escalation via predictable /tmp extraction directorySimilar attack · NVD/CVE Database
• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek