CVE-2026-39413 LightRAG has a JWT Algorithm Confusion Vulnerability in LightRAG API
Attackers can bypass authentication in LightRAG API by forging JWT tokens with the 'none' algorithm, gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-39413?
CVE-2026-39413 is a medium-severity authentication bypass vulnerability in HKUDS LightRAG, published on 8 Apr 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.4.14, the LightRAG API is vulnerable to a JWT algorithm confusion attack where an attacker can forge tokens by specifying 'alg': 'none' in the JWT header. Since the jwt.decode() call does not explicitly deny the 'none' algorithm, a crafted token without a signature will be accepted as valid, leading to unauthorized access. This vulnerability is fixed in 1.4.14.
Weakness: CWE-347
Which versions are affected by CVE-2026-39413?
3 open source packages ship an affected version, including lightrag-hku. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lightrag-hku PyPI | All versions | 1.4.14 |
lightrag-hku PyPI | All versions | 1.4.14 |
lightrag-hku PyPI | All versions | 1.4.14 |
Products include Hkuds Lightrag.
How do I fix CVE-2026-39413?
Upgrade lightrag-hku to 1.4.14 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-39413 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-39413 exists.
Sources
Also known as GHSA-8ffj-4hx4-9pgf, PYSEC-2026-2592.