CVE-2026-85734 – Authentication Brute-Force (Credential Stuffing) – HKUDS LightRAG < 1.5.5

Summary

CVE-2026-85734 is a critical improper restriction of excessive authentication attempts (CWE-307) vulnerability in HKUDS’ LightRAG, an open-source retrieval-augmented generation (RAG) framework. The POST /login endpoint accepts unlimited authentication attempts with no rate limiting, delay, lockout, or attempt counter, allowing a remote, unauthenticated attacker to brute-force valid credentials at full request speed. The issue affects versions prior to 1.5.5 and carries a CVSS v3.1 base score of 9.1 (Critical).

Technical details

• Root cause: The login handler in lightrag/api/lightrag_server.py processes credential submissions without any throttling, delay, CAPTCHA, or account-lockout mechanism; the codebase contains no rate-limiting or throttling logic (e.g., no use of slowapi, rate_limit, lockout, or throttle in the API code).
• Trigger conditions: An attacker sends repeated POST /login requests with different password guesses against a known or guessable username; no prior authentication or user interaction is required.
• Attack vector: Network — the login endpoint is exposed over HTTP(S) and reachable by any remote, unauthenticated party.
• Impact: Successful credential guessing grants an attacker full authenticated access to the LightRAG instance, including stored documents, the knowledge graph, and administrative operations, resulting in high confidentiality and integrity impact.

Affected software

• HKUDS LightRAG (PyPI package lightrag-hku) versions up to and including 1.5.3 (all releases prior to 1.5.5) are affected.

Severity

• CVSS v3.1 Base Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Mitigation and recommended actions

• Immediate: Upgrade LightRAG to version 1.5.5 or later, which addresses the missing rate-limiting/lockout controls on the login endpoint.
• If immediate patching is not possible:
  • Restrict network exposure of the LightRAG management/login interface (e.g., place it behind a VPN, IP allowlist, or internal network segment) so it is not reachable from the public internet.
  • Deploy a reverse proxy or web application firewall (WAF) in front of the instance to enforce rate limiting, request throttling, or CAPTCHA on the /login endpoint.
  • Enforce strong, unique passwords for all LightRAG accounts and rotate credentials to reduce the risk of successful brute-force guessing while remediation is in progress.
  • Monitor authentication logs for high-volume failed login attempts against the /login endpoint.

References

• GitHub Security Advisory GHSA-frch-4w6v-q5xx
• CVE-2026-85734 Record (CVEProject/cvelistV5)
• LightRAG Release v1.5.5