CVE-2026-85740: LightRAG SSRF Vulnerability

CVE-2026-85740 Overview

CVE-2026-85740 is a Server-Side Request Forgery (SSRF) vulnerability in LightRAG, a retrieval-augmented generation framework. Versions prior to 1.5.5 fail to properly validate IPv4 addresses embedded within IPv6 transition wrappers. An authenticated user who can upload Markdown or textpack documents can reference external image URLs using NAT64 64:ff9b::/96 or IPv4-compatible IPv6 forms that embed loopback, RFC 1918 private, or cloud metadata addresses. On deployments with NAT64 or DNS64 routing, the _download and _build_guarded_opener functions accept the wrapper and fetch the internal resource, whose response body is then ingested into the RAG pipeline.

Critical Impact
Attackers with document upload privileges can read internal network resources, including cloud instance metadata endpoints, and exfiltrate the contents through the RAG ingestion pipeline.

Affected Products

LightRAG versions prior to 1.5.5
lightrag/parser/markdown/parser.py module
Deployments configured with NAT64 or DNS64 routing

Discovery Timeline

2026-09-22 - CVE-2026-85740 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-85740

Vulnerability Analysis

The vulnerability [CWE-918] resides in the _validated_addresses function within lightrag/parser/markdown/parser.py. The function evaluates literal resolved addresses using Python's ipaddress.is_global method, which does not consistently classify an IPv4 address embedded in an IPv6 transition wrapper. When a Markdown document references an image at a NAT64-encoded address such as 64:ff9b::7f00:1, the underlying IPv4 target (127.0.0.1 in this example) is not recognized as internal.

On hosts configured with NAT64 or DNS64 translation, or with 6to4 routing, the operating system delivers the outbound HTTP request to the embedded IPv4 destination. LightRAG then ingests the response body, effectively bridging an untrusted document into internal services.

Root Cause

CPython's is_global implementation classifies several IPv6 wrappers that embed internal IPv4 addresses as globally routable. The original LightRAG guard performed a single is_global check against the literal IPv6 address without first decoding the embedded IPv4. Wrappers including IPv4-mapped (::ffff:0:0/96), IPv4-compatible (::/96), NAT64 well-known (64:ff9b::/96), RFC 8215 local-use NAT64 (64:ff9b:1::/48), and 6to4 (2002::/16) all bypass the check when they encapsulate loopback, RFC 1918, or link-local metadata addresses.

Attack Vector

An attacker requires the ability to upload a Markdown or textpack document. The document references an external image URL constructed with an IPv6 transition wrapper that embeds an internal IPv4 target such as 169.254.169.254 (cloud metadata) or 127.0.0.1 (loopback). LightRAG's parser fetches the URL, resolves it through the host's NAT64/DNS64 stack to the internal target, and ingests the returned content.

python

# Security patch — decode IPv6 transition wrappers before is_global check
# Source: https://github.com/HKUDS/LightRAG/commit/a25862177a9b00e0edb870778a42b4155924de09

def _unwrap_embedded_ipv4(ip):
    """Return the IPv4 embedded in an IPv6 transition wrapper so it is judged by
    IPv4 rules; otherwise return ``ip`` unchanged.

    Handled wrappers: IPv4-mapped (``::ffff:0:0/96``), IPv4-compatible
    (``::/96``, minus ``::``/``::1``), the NAT64 well-known prefix
    (``64:ff9b::/96``, RFC 6052) and the RFC 8215 local-use prefix
    (``64:ff9b:1::/48``), and 6to4 (``2002::/16``).
    """
    if ip.version != 6:
        return ip
    if ip.ipv4_mapped is not None:
        # ... decode and reclassify as IPv4

# Additional patch — default-deny RFC 8215 local-use NAT64 /48
# Source: https://github.com/HKUDS/LightRAG/commit/9207e7fd10cf6df3cf26e3dd1921490b34a2f132
_FORCE_NON_GLOBAL_V6 = (ip_network("64:ff9b:1::/48"),)

Detection Methods for CVE-2026-85740

Indicators of Compromise

Outbound HTTP requests from the LightRAG process to IPv6 addresses matching 64:ff9b::/96, 64:ff9b:1::/48, 2002::/16, ::ffff:0:0/96, or ::/96.
Ingestion logs referencing image URLs containing IPv6 literals with embedded IPv4 octets such as 64:ff9b::a9fe:a9fe (169.254.169.254) or 64:ff9b::7f00:1 (127.0.0.1).
RAG document content that includes cloud instance metadata fields, IAM credentials, or internal service responses.

Detection Strategies

Inspect uploaded Markdown and textpack documents for image references containing IPv6 transition prefixes before ingestion.
Monitor the LightRAG worker process for connections to link-local (169.254.0.0/16), loopback, or RFC 1918 destinations reached via NAT64/DNS64 translation.
Review LightRAG version strings across deployments and flag any instance below 1.5.5.

Monitoring Recommendations

Enable egress logging on hosts running LightRAG and alert on any connection to cloud metadata endpoints.
Baseline expected outbound destinations from the LightRAG parser and alert on deviations, especially IPv6 destinations.
Correlate document upload events with subsequent outbound fetches to detect SSRF probing patterns.

How to Mitigate CVE-2026-85740

Immediate Actions Required

Upgrade LightRAG to version 1.5.5 or later, which includes the fixed _unwrap_embedded_ipv4 guard and default-deny for 64:ff9b:1::/48.
Audit recent document uploads for Markdown or textpack files containing IPv6 image URLs with embedded IPv4 addresses.
Restrict document upload privileges to trusted users until patching is complete.

Patch Information

The vulnerability is fixed in LightRAG version 1.5.5. The remediation is delivered through commits a258621, 9207e7f, and c598545, consolidated in Pull Request 3426. See the GHSA-vv3m-f8x4-7377 security advisory and the v1.5.5 release notes for details.

Workarounds

Disable NAT64 and DNS64 translation on hosts running LightRAG where operationally feasible.
Route LightRAG egress traffic through an HTTP proxy that enforces destination allowlists and rejects internal IPv4 targets.
Block outbound access from the LightRAG process to cloud metadata endpoints, loopback, and RFC 1918 networks at the host firewall.

bash

# Upgrade LightRAG to the fixed release
pip install --upgrade "lightrag>=1.5.5"

# Optional: pin allowed non-public CIDRs only when explicitly required
export NATIVE_MD_IMAGE_ALLOWED_NON_PUBLIC_CIDRS=""

# Verify installed version
python -c "import lightrag; print(lightrag.__version__)"