Exposure of Sensitive Information in LightRAG API Server

CVE-2026-85709

What is CVE-2026-85709?

The LightRAG API server prior to version 1.5.5 exhibits a vulnerability that allows unauthenticated clients to receive detailed error messages. These messages can leak sensitive information such as server filesystem paths, database connection details, and configuration settings, making them exploitable by malicious users. An attacker may leverage this exposure to gain insights into the system's architecture and potentially compromise the databases or services it connects to. This vulnerability has been addressed in version 1.5.5, which implements measures to prevent such information disclosure.

References