TI-2026-58831 Aliases CVE-2026-85734 GHSA-frch-4w6v-q5xx

LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

MEDIUM 48CWE-307Published 2026-09-22 · Updated 2026-09-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-307.

Summary

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00609 49th percentileScored 2026-11-07

Fix Fixed LightRAG (HKUDS): 1.5.5lightrag-hku (PyPI): 1.5.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HKUDS	LightRAG	before 1.5.5	1.5.5	Patch available	CNA
—	lightrag-hku (PyPI)	before 1.5.5	1.5.5	Patch available	GHSA-frch-4w6v-q5xx

LightRAG VendorHKUDS Affected before 1.5.5 Fixed in 1.5.5 Patch available CNA
lightrag-hku (PyPI) Vendor— Affected before 1.5.5 Fixed in 1.5.5 Patch available GHSA-frch-4w6v-q5xx

Remediation

Fix · CNA LightRAG (HKUDS) Fixed in 1.5.5
Fix · GHSA-frch-4w6v-q5xx lightrag-hku (PyPI) Fixed in 1.5.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-85734
2026-10-03 Alias added: GHSA-frch-4w6v-q5xx

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-85734

Other 5

TI-2026-44237 LightRAG: Missing Authentication for Critical API Functions in Default Configuration CVSS 3.1CRITICAL 9.8
TI-2026-78721 Missing authentication in HKUDS Vibe-Trading FastAPI server enables RCE CVSS 4.0CRITICAL 9.3
TI-2026-44184 Improper authentication in HKUDS LightRAG CVSS 4.0CRITICAL 9.3
TI-2026-26034 Zero-Click Indirect Prompt Injection and Authentication Bypass via Email Polling CVSS 4.0HIGH 8.9
TI-2026-62432 HKUDS nanobot before 0.3.0 Server-Side Request Forgery via WebFetchTool CVSS 4.0CRITICAL 9.2
TI-2026-25310 DeepCode 1.2.0 Path Traversal via SPA Catch-All Route in main.py CVSS 4.0HIGH 8.7

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences