CVE-2026-85734

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/HKUDS/LightRAG/commit/135bc9056e9ecd800c1abe2f2ce24d1a86622a54
https://github.com/HKUDS/LightRAG/pull/3424
https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5
https://github.com/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx

Configurations

No configuration.

History

22 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-22 17:17

Updated : 2026-09-22 18:17

NVD link : CVE-2026-85734

Mitre link : CVE-2026-85734

CVE.ORG link : CVE-2026-85734

JSON object : View

Products Affected

No product.

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2026-85734", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-85734", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-22T17:36:54.076707Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "HKUDS", "product": "LightRAG", "versions": [{"status": "affected", "version": "< 1.5.5"}]}]}], "published": "2026-09-22T17:17:27.367", "references": [{"url": "https://github.com/HKUDS/LightRAG/commit/135bc9056e9ecd800c1abe2f2ce24d1a86622a54", "source": "security-advisories@github.com"}, {"url": "https://github.com/HKUDS/LightRAG/pull/3424", "source": "security-advisories@github.com"}, {"url": "https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5", "source": "security-advisories@github.com"}, {"url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found. Successful credential recovery grants authenticated access to documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5."}], "lastModified": "2026-09-22T18:17:23.530", "sourceIdentifier": "security-advisories@github.com"}