CVE-2026-85734: LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LightRAGto a version that resolves this vulnerability.Fixed in 1.5.5
Event History
Frequently Asked Questions
Which deployments are exposed?
LightRAG deployments running a version earlier than 1.5.5 are exposed if an attacker can reach the POST /login endpoint over the network.
What does an attacker need to exploit this issue?
An attacker does not need prior authentication or user interaction. They need network access to the login endpoint and can repeatedly submit password guesses until finding valid account credentials.
What access could a successful attack provide?
Recovered credentials provide authenticated access to documents, the knowledge graph, and administrative operations.
What is the remediation?
Upgrade LightRAG to version 1.5.5, which fixes the missing login rate limiting protections.