CVE-2026-85734 json
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
published last mo. modified last mo. also EUVD-2026-84548 , GHSA-frch-4w6v-q5xx , PYSEC-2026-4062
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 49%
- public exploits
- 0
- none known
Summary
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.
Patch / fix
- pypi lightrag-hku 1.5.5
- hkuds lightrag 1.5.5
- github.com/HKUDS/LightRAG@135bc90 commit
- github.com/HKUDS/LightRAG#3424 pull request
- github.com/HKUDS/LightRAG/releases/tag/v1.5.5 release
Is CVE-2026-85734 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- last mo.
Exploit prediction
0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| OSV | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | lightrag-hku | <1.5.5 |
1.5.5 |
Affected products
- HKUDS LightRAG
Classification
- Weakness
-
- CWE-307 Improper Restriction of Excessive Authentication Attempts
References
-
github.com
/HKUDS/LightRAG/pull/3424
web
-
github.com
/HKUDS/LightRAG/commit/135bc9056e9ecd800c1abe2f2ce24d1a86622a54
web
-
github.com
/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx
web
-
github.com
/HKUDS/LightRAG/releases/tag/v1.5.5
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-85734
advisory
-
github.com
/HKUDS/LightRAG
package
-
pypi.org
/project/lightrag-hku
package
-
github.com
/advisories/GHSA-frch-4w6v-q5xx
advisory
Sources
- CVE List CVE-2026-85734
- GitHub Advisory GHSA-frch-4w6v-q5xx
- NVD CVE-2026-85734
- OSV PYSEC-2026-4062
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.