Stop guest tokens from bypassing X-API-Key auth
fix(api): stop guest tokens from bypassing X-API-Key auth
Stop guest tokens from bypassing X-API-Key authf7819a-fix-stop-guest-tokens-from-bypassing-x-api-key-cve-2026-61740fixstop guest tokens bypassing api key
Committed by danielaskdd
commit message
fix(api): stop guest tokens from bypassing X-API-Key auth
In the API-key-only profile (LIGHTRAG_API_KEY set, AUTH_ACCOUNTS unset),
`combined_dependency` short-circuited authorization for any valid guest
token before the X-API-Key check. Because that mode falls back to the
public DEFAULT_TOKEN_SECRET, an unauthenticated attacker could mint a
guest JWT (offline, or by fetching one from the open /auth-status and
/login endpoints) and call every protected endpoint without the API key.
An anonymous request was correctly rejected with 403, but the same
request carrying a forged guest token returned 200 — a real auth bypass,
not the "open by design" guest mode it was mistaken for.
Fix: accept guest tokens only when neither password auth nor an API key
is configured (the genuinely fully-open profile). When an API key is set,
a guest token is ignored and the request falls through to the mandatory
X-API-Key check rather than short-circuiting or hard-failing with 401 —
so the WebUI flow (which sends both Authorization and X-API-Key) keeps
working and simply prompts for the API key.
Reported in GHSA-f4vv-55c2-5789 and GHSA-xr5c-v5r6-c9f9. Mirrors the
invariant already enforced for the AUTH_ACCOUNTS path by CVE-2026-30762.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>Editor assessment
This commit patches CVE-2026-61740. The subject states the effect plainly: stop guest tokens from bypassing X-API-Key auth. The body is a model security write-up, explaining that combined_dependency short-circuited on any valid guest token before the API key check, and that the API-key-only profile falls back to a public default secret, letting an attacker mint a guest JWT offline or from the open endpoints. It documents the observed difference between a 403 anonymous request and a 200 response carrying a forged token, then lays out the fix and its effect on the WebUI flow. Both advisories are cited in prose.