CVE-2026-85709: LightRAG Information Disclosure Vulnerability

CVE-2026-85709 Overview

CVE-2026-85709 is an information disclosure vulnerability in LightRAG, a retrieval-augmented generation framework maintained by HKUDS. Versions prior to 1.5.5 return raw Python exception text from error handlers in the LightRAG API server. The affected handlers reside in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. Unauthenticated network clients can trigger errors and receive server filesystem paths, database host, port, user, database names, language-model provider diagnostics, and Python library internals. When backends are configured with URI connection strings, driver errors can expose embedded credentials. The issue is classified as [CWE-209] Generation of Error Message Containing Sensitive Information.

Critical Impact
An unauthenticated remote attacker can extract server configuration, filesystem layout, and potentially database credentials by triggering error conditions in the LightRAG API server.

Affected Products

LightRAG API server versions prior to 1.5.5
Deployments running the default unauthenticated configuration
Instances using URI-configured database backends where driver errors may include credentials

Discovery Timeline

2026-09-22 - CVE-2026-85709 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-85709

Vulnerability Analysis

The LightRAG API server uses FastAPI HTTPException responses to communicate errors to clients. Multiple handlers construct these responses with detail=str(e) or detail=str(exc), passing raw Python exception messages directly to the network client. Exception messages generated by database drivers, filesystem operations, and language-model provider libraries often embed sensitive runtime state.

An attacker probes endpoints with malformed inputs or values that trigger backend errors. The server responds with the underlying exception text, which can contain absolute file paths, database DSN fragments, hostnames, ports, usernames, and library stack context. This exposure aids reconnaissance and can accelerate follow-on attacks against the database or host.

Root Cause

The root cause is unsanitized propagation of exception messages into HTTP response bodies. Handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py did not wrap or filter exception content before returning it. The default unauthenticated deployment posture makes those endpoints reachable to any network client that can reach the API port.

Attack Vector

Exploitation requires only network access to the LightRAG API. An attacker submits crafted requests that force validation failures, database errors, or model provider errors. The API returns HTTP 422 or 500 responses containing raw exception content. No credentials or user interaction are required in the default configuration.

python

             try:
                 _resolve_text_chunking(request.chunking, rag)
             except ValueError as exc:
-                raise HTTPException(status_code=422, detail=str(exc))
+                # Controlled chunking-config validation message (numeric sizes
+                # only, no internal detail); kept as client-facing 422 feedback
+                # but wrapped so it is never a bare raw-exception passthrough.
+                raise HTTPException(
+                    status_code=422,
+                    detail=f"Invalid chunking configuration: {exc}",
+                )

             # Generate track_id for text insertion
             track_id = generate_track_id("insert")

Source: GitHub Commit 4d90a0e. The patch wraps the raw exception into a bounded, client-safe message rather than passing it through unmodified.

Detection Methods for CVE-2026-85709

Indicators of Compromise

HTTP 422 or 500 responses from LightRAG endpoints whose JSON detail field contains absolute filesystem paths, database DSNs, or Python traceback fragments.
Bursts of malformed requests to /documents, /graph, /query, or /api/* endpoints from a single source, consistent with error-probing.
Outbound response payloads containing strings such as postgresql://, mongodb://, Traceback, or driver-specific error prefixes.

Detection Strategies

Inspect API response bodies at the reverse proxy or WAF for exception patterns and connection-string fragments before responses leave the trust boundary.
Correlate high rates of 4xx and 5xx responses on LightRAG endpoints with reconnaissance behavior from unauthenticated sources.
Search application logs for handlers still emitting detail=str(e) or detail=str(exc) patterns to identify unpatched instances.

Monitoring Recommendations

Enable structured access logging on the LightRAG API and forward it to a centralized log platform for query and alerting.
Alert on outbound response bodies containing credential-shaped strings or filesystem paths from API services.
Track deployed LightRAG versions across environments and flag any host running a version earlier than 1.5.5.

How to Mitigate CVE-2026-85709

Immediate Actions Required

Upgrade LightRAG to version 1.5.5 or later as published in the GitHub Release v1.5.5.
Rotate any database credentials, API keys, or model provider tokens that may have been exposed through prior error responses.
Enable authentication on the LightRAG API server and restrict network exposure to trusted clients only.

Patch Information

The fix is delivered in LightRAG 1.5.5 via GitHub Pull Request #3422. Commits 4d90a0e and dcab315 sanitize HTTP 422 chunking-validation messages and stop leaking raw exception text in HTTP 500 responses by introducing an internal_server_error helper. Additional context is available in the GitHub Security Advisory GHSA-hrmj-7rvj-4hg8.