CVE-2026-85734: lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

September 22, 2026

The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed.

References

github.com/HKUDS/LightRAG/commit/135bc9056e9ecd800c1abe2f2ce24d1a86622a54
github.com/HKUDS/LightRAG/pull/3424
github.com/HKUDS/LightRAG/releases/tag/v1.5.5
github.com/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx
github.com/advisories/GHSA-frch-4w6v-q5xx
nvd.nist.gov/vuln/detail/CVE-2026-85734

Code Behaviors & Features

Detect and mitigate CVE-2026-85734 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →