LightRAG API Missing Authentication Vulnerability

Vulnerability Overview Title: Missing Authentication for Critical API Functions in Default Configuration Description: The LightRAG API server ( ) runs with authentication disabled by default and binds to (all network interfaces). Under this default configuration, all management and data endpoints (such as document upload/deletion, knowledge graph mutations, cache clearing, pipeline operations, and LLM queries) are accessible without any credentials. This results in a fully open server unless authentication is explicitly configured. Affected Versions: All released versions, including 1.5.4 and earlier. Prior to 1.5.5, there were no startup or documentation warnings. Version 1.5.5 intentionally changed the default binding behavior to break existing local and Docker deployments, but added prominent prompts—see the "Remediation and Mitigation" section. Details: Authentication relies on , which intentionally allows all requests when and are not configured. Both values default to empty sets, and the server binds to all interfaces with a wildcard CORS policy ( ). The unauthenticated endpoint ( ) issues a valid JWT token when authentication is not configured. Additional residual exposure (independent of the default no-auth issue): The default exempts and (including Ollama-compatible endpoints and ) from authentication, even when authentication is enabled. Affected Endpoints (all accessible without authentication): (POST): Upload arbitrary documents (DELETE): Delete all documents and clear storage (DELETE): Delete a single document (POST): Clear LLM response cache (POST): Cancel running pipeline (POST): Insert arbitrary text (POST): Batch insert arbitrary text (POST): Query knowledge base (data read + LLM cost) (POST): Streaming query (keeps connection alive) (POST): Structured data query (POST): Modify graph entities (POST): Create graph entities (POST): Modify graph relations (POST): Create graph relations (POST): Merge graph entities (DELETE): Delete graph entities (DELETE): Delete graph relations (POST): LLM generation (Ollama compatible; also exempted via default ) (POST): LLM chat (Ollama compatible; also exempted via default ) Impact Scope Confidentiality: Read all indexed document contents, enumerate documents, and list graph entities/relations. Integrity: Upload arbitrary documents, insert arbitrary text, create/modify/delete knowledge graph entities and relations, and inject false information. Availability: Delete all documents and storage, cancel pipelines, clear LLM cache, and consume LLM API credits (direct financial impact). Default Docker Compose deployments map port 9621 to , making the server accessible from the host network and, if the host firewall allows, from external networks. Remediation and Mitigation Security Banner on Startup: Printed along the uvicorn and gunicorn startup paths. A security alert is issued when the server binds to a non-loopback address and authentication is not configured. When authentication is enabled, the default whitelist still exempts Ollama routes; on non-loopback bindings, it prints a notice regarding these routes. Setup Wizard: Recommends configuring authentication when the host is non-loopback and authentication is not configured. The output is informational only—it does not modify written content. Documentation: , , , and three Docker Compose files ( , , ) now document the authentication/exposure trade-offs, including that Ollama-compatible routes remain open by default and can be locked via . Operators must before exposing the server to any untrusted network: 1. Set or along with a non-default ; and/or 2. Bind to a loopback address ( ) for local access; and 3. Optionally narrow to protect Ollama-compatible endpoints ( , ). Fix/Mitigation Version: 1.5.5 POC Code

Goal Reached Thanks to every supporter — we hit 100%!

LightRAG API Missing Authentication Vulnerability

More from this source