Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

lightrag-hku login allows unlimited password guessing

CVE-2026-85734 · published 23 days ago
Summary

The login function in lightrag-hku does not limit how many times someone can try to sign in, so an attacker can repeatedly guess passwords until one works. This could let an unauthorized person view your documents, knowledge graph, and perform admin tasks. Upgrade to version 1.5.5, which adds limits and lockout protections, or apply a similar restriction manually.

What to do
  • Update lightrag-hku to version 1.5.5.
Affected software
Ecosystem VendorProductAffected versions
– hkuds lightrag < 1.5.5
pip – lightrag-hku < 1.5.5
Fix: upgrade to 1.5.5
Original advisory text
lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published22 Sep 2026
Updated15 Oct 2026
First seen22 Sep 2026
Sources
CVE-2026-85734 · NVD
CVE-2026-85734 · MITRE
GHSA-frch-4w6v-q5xx · GHSA
CVE-2026-85734 · OSV
GHSA-frch-4w6v-q5xx · OSV
PYSEC-2026-4062 · OSV
Track software like this
Free during beta