medium4.2
CVE-2026-39413
LightRAG provides simple and fast retrieval-augmented generation.
Impact
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode() call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access. This vulnerability is fixed in 1.4.14.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | lightrag-hku | <= 1.4.13 | 1.4.14 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hkuds | Lightrag | before 1.4.14 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-8ffj-4hx4-9pgf
- https://github.com/HKUDS/LightRAG/security/advisories/GHSA-8ffj-4hx4-9pgf
- https://github.com/HKUDS/LightRAG/commit/728f2e54509d93e0a44f929c7f83f2c88d6d291b
- https://nvd.nist.gov/vuln/detail/CVE-2026-39413
- https://github.com/github/advisory-database/issues/7373