Summary
LightRAG can be vulnerable to server-side request forgery when an uploaded Markdown or textpack document contains an external image URL using certain IPv6 transition forms. On deployments with compatible NAT64 or DNS64 routing, an attacker may cause the server to fetch loopback, private-network, or cloud metadata resources and ingest their responses.
Affected context
The issue occurs in LightRAG deployments that process user-uploaded Markdown or textpack documents and download referenced external images. It is relevant when address validation does not consistently identify IPv4 addresses embedded in IPv6 transition wrappers, and when the deployment network can route those wrappers through NAT64 or DNS64. The affected behavior is associated with versions before the parser's address-validation fix.
Exploit preconditions
- Attack surface: Markdown or textpack document upload and external image retrieval
- Required access: Ability to submit or cause processing of a document containing an image URL
- Trigger point: URL validation followed by image download during document ingestion
- Network condition: Compatible NAT64 or DNS64 routing must allow the wrapped address to reach an internal destination
- Why exploitation is possible: Address validation may treat the IPv6 wrapper as globally reachable without consistently evaluating the embedded IPv4 address
Why this happens
The root cause is incomplete validation of IPv6 transition addresses before making server-side requests. The parser evaluates the literal resolved address with a global-address check, but some wrappers can encode loopback, private, or metadata-service IPv4 destinations. When the wrapper is accepted by the download guard, the server becomes an unintended proxy to internal resources. This behavior maps to CWE-918, where attacker-influenced URLs cause a server to initiate requests to restricted destinations.
Potential impact
- An attacker may read responses from loopback or private-network services
- The application could expose cloud instance metadata or temporary credentials
- Retrieved internal content may be ingested into the retrieval corpus
- Internal service information could support further compromise or lateral movement
- Resource consumption may increase if the server is used to make repeated internal requests
General mitigation guidance
Mitigation typically focuses on validating the final network destination rather
than trusting the apparent URL representation.
Common defensive patterns include:
- Resolve and classify all supported IPv4, IPv6, and transition-wrapper forms consistently
- Reject loopback, link-local, private, reserved, multicast, and cloud-metadata destinations
- Apply egress allowlists or isolated fetcher services for externally referenced content
- Revalidate destinations after resolution and account for DNS rebinding and redirect behavior
- Separate document retrieval from sensitive network zones and use least-privilege network policies
- Prefer disabling remote image fetching when it is not required
- Limit downloaded content, response size, redirects, and request time
How teams detect issues like this
Organizations commonly detect SSRF risks through:
- Static analysis rules for user-controlled URLs passed to HTTP clients
- Code review checks covering URL parsing, DNS resolution, redirects, and IPv4-in-IPv6 representations
- Tests for loopback, private, link-local, metadata, NAT64, 6to4, and IPv4-compatible address forms
- Egress firewall and proxy policies that deny application access to internal address ranges
- Runtime monitoring for document-ingestion processes contacting internal hosts or metadata endpoints
- Automated security review tools that flag missing destination validation and unrestricted outbound requests
