LightRAG’s API server displayed raw Python exception text in several error handlers prior to version 1.5.5. When errors were raised, the exception details, including server file paths, database connection information, language‑model provider diagnostics, and internal library data, were returned to the requesting client. This disclosure provided an attacker with sensitive configuration data and environmental details that could facilitate further attacks, such as guessing credentials or crafting targeted exploits.

All releases of the HKUDS LightRAG product before v1.5.5 are affected, including the components document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The vulnerability exists in the default unauthenticated configuration and also in setups where backend drivers expose connection strings through error messages. Users running any pre‑1.5.5 LightRAG instance should consider the upgrade immediately.

The CVSS base score of 5.3 indicates moderate severity, but the attack can be performed over the network without authentication due to the default public API. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a client sending malformed or unexpected data to trigger an exception, after which the server returns the raw error payload containing sensitive information.