Skip to content
Heist/ feed
Back to feed
Critical

LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

Type: advisorySources: OSV

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-85734
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 07:35 UTC · Revision 1

Source evidence

LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

core-osv · Original source

Published 22 Sept 2026, 16:18 UTC

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.

osv:CVE-2026-85734
Complete source record
{
  "id": "308a4396efab4af602f752065ef09ef9248e72a827beb43d985fd42e1c877ec9",
  "url": "https://osv.dev/vulnerability/CVE-2026-85734",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks",
    "summary": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.",
    "evidence": "osv:CVE-2026-85734",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2026-85734",
      "aliases": [
        "CVE-2026-85734",
        "GHSA-frch-4w6v-q5xx",
        "PYSEC-2026-4062"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/hkuds/lightrag",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "22ea2d0cbfa2b7002aa118bd0bf1780a69d489bc"
                },
                {
                  "fixed": "135bc9056e9ecd800c1abe2f2ce24d1a86622a54"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.5.5"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "135bc9056e9ecd800c1abe2f2ce24d1a86622a54"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "range": [
                      {
                        "fixed": "22ea2d0cbfa2b7002aa118bd0bf1780a69d489bc"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.5.5"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.5.5rc1",
            "v1.5.4",
            "temp",
            "v1.5.3",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.5.0rc3",
            "v1.5.0rc2",
            "v1.4.9.1",
            "v1.4.16",
            "v1.4.15",
            "v1.4.14",
            "v1.4.13",
            "v1.4.13rc1",
            "v1.4.12",
            "v1.4.12rc1",
            "v1.4.11",
            "v1.4.11rc1",
            "v1.4.11rc2",
            "v1.4.10",
            "v1.4.9.11",
            "v1.4.9.10",
            "v1.4.9.9",
            "v1.4.9.8",
            "v1.4.9.7",
            "v1.4.9.6",
            "v1.4.9.5",
            "v1.4.9.4",
            "v1.4.9.4rc1",
            "v1.4.9.3",
            "v1.4.9.2",
            "v1.4.9",
            "v1.4.9rc4",
            "v1.4.9rc3",
            "v1.4.9rc2",
            "v1.4.9rc1",
            "v1.4.8.2",
            "v1.4.8.1",
            "v1.4.8",
            "v1.4.8rc9",
            "v1.4.8rc8",
            "v1.4.8rc5",
            "v1.4.8rc4",
            "v1.4.8rc3",
            "v1.4.8rc1",
            "v1.4.7",
            "v1.4.7rc2",
            "v1.4.6",
            "v1.4.5",
            "v1.4.4",
            "v1.4.3",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.10",
            "v1.3.9",
            "v1.3.8",
            "v1.3.7",
            "v1.3.6",
            "v1.3.4",
            "v1.3.3",
            "v1.3.2",
            "v1.3.1",
            "v1.3.0",
            "v1.2.9",
            "v1.2.8",
            "v1.2.7",
            "v1.2.6",
            "v1.2.5",
            "v1.2.3",
            "v1.2.2",
            "v1.2.1",
            "v1.1.12",
            "v1.1.11",
            "v1.1.10",
            "v1.1.9",
            "v1.1.8",
            "v1.1.7",
            "v1.1.6",
            "v1.1.5",
            "v1.1.4",
            "v1.1.3",
            "v1.1.2",
            "v1.1.1",
            "v1.1.0",
            "v1.0.9",
            "v1.0.8",
            "v1.0.7",
            "v1.0.6",
            "v1.0.5"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85734.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.700564594Z",
      "provider": "osv",
      "references": [
        "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85734.json",
        "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-85734",
        "https://github.com/HKUDS/LightRAG/commit/135bc9056e9ecd800c1abe2f2ce24d1a86622a54",
        "https://github.com/HKUDS/LightRAG/pull/3424"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-307"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85734.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-85734",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 493417,
  "published_at": "2026-09-22T16:18:14.144+00:00"
}