id: PYSEC-2026-2593
published: "2026-07-13T14:36:47.915970Z"
modified: "2026-07-13T16:04:35.729066Z"
aliases:
- CVE-2026-30762
- GHSA-mcww-4hxq-hfr3
summary: "LightRAG: Hardcoded JWT Signing Secret Allows Authentication Bypass"
details: "Subject: Security Vulnerability Report Hardcoded JWT Secret (CVE-2026-30762)\n\nHi HKUDS team,\n\nI'm writing to report a security vulnerability I discovered in LightRAG v1.4.10. This has been assigned CVE-2026-30762 by MITRE.\n\nVulnerability: Hardcoded JWT signing secret\nType: Improper Authentication (CWE-287)\nSeverity: High\nAttack Vector: Remote / Unauthenticated\n\nSummary:\nThe file lightrag/api/config.py (line 397) uses a default JWT secret \"lightrag-jwt-default-secret\" when the TOKEN_SECRET environment variable is not set. The AuthHandler in lightrag/api/auth.py (lines 24-25) uses this secret to sign and verify tokens. An unauthenticated attacker can forge valid JWT tokens using the publicly known default secret and gain access to any protected endpoint.\n\nReproduction:\n1. Install LightRAG v1.4.10 with AUTH_ACCOUNTS configured but no TOKEN_SECRET set\n2. Use PyJWT to sign a token: jwt.encode({\"sub\": \"admin\", \"role\": \"user\"}, \"lightrag-jwt-default-secret\", algorithm=\"HS256\")\n3. Send a request to any protected endpoint with the header: Authorization: Bearer <forged_token>\n4. Access is granted without valid credentials\n\nSuggested Fix:\nRequire TOKEN_SECRET to be explicitly set when AUTH_ACCOUNTS is configured. Refuse to start the API server if authentication is enabled but no custom secret is provided.\n\nI'm following a 90-day responsible disclosure timeline from today's date. Please let me know if you have any questions or need additional information.\n\nBest regards,\nVenkata Avinash Taduturi"
affected:
- package:
    name: lightrag-hku
    ecosystem: PyPI
    purl: pkg:pypi/lightrag-hku
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.4.13
  versions:
  - 0.0.2
  - 0.0.3
  - 0.0.4
  - 0.0.5
  - 0.0.6
  - 0.0.7
  - 0.0.8
  - 0.0.9
  - 1.0.0
  - 1.0.1
  - 1.0.3
  - 1.0.5
  - 1.0.6
  - 1.0.8
  - 1.0.9
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.1.3
  - 1.1.4
  - 1.1.5
  - 1.1.6
  - 1.1.7
  - 1.2.1
  - 1.2.2
  - 1.2.3
  - 1.2.5
  - 1.2.6
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.3.3
  - 1.3.4
  - 1.3.5
  - 1.3.6
  - 1.3.7
  - 1.3.8
  - 1.3.9
  - 1.4.0
  - 1.4.1
  - 1.4.10
  - 1.4.11
  - 1.4.11rc2
  - 1.4.12
  - 1.4.12rc1
  - 1.4.13rc1
  - 1.4.2
  - 1.4.3
  - 1.4.4
  - 1.4.5
  - 1.4.6
  - 1.4.7
  - 1.4.8.1
  - 1.4.8.2
  - 1.4.8rc4
  - 1.4.8rc6
  - 1.4.8rc7
  - 1.4.8rc8
  - 1.4.8rc9
  - 1.4.9
  - 1.4.9.1
  - 1.4.9.10
  - 1.4.9.11
  - 1.4.9.2
  - 1.4.9.3
  - 1.4.9.4
  - 1.4.9.4rc1
  - 1.4.9.5
  - 1.4.9.6
  - 1.4.9.7
  - 1.4.9.8
  - 1.4.9.9
  - 1.4.9rc1
  - 1.4.9rc2
  - 1.4.9rc3
  - 1.4.9rc4
references:
- type: WEB
  url: https://github.com/HKUDS/LightRAG/security/advisories/GHSA-mcww-4hxq-hfr3
- type: PACKAGE
  url: https://github.com/HKUDS/LightRAG
- type: PACKAGE
  url: https://pypi.org/project/lightrag-hku
- type: ADVISORY
  url: https://github.com/advisories/GHSA-mcww-4hxq-hfr3
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2026-30762
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N