CVE-2026-85734: lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

September 22, 2026

The POST /login endpoint has no rate limiting, account lockout, or delay on failed attempts. An attacker can submit unlimited password guesses at full network speed.

References

github.com/HKUDS/LightRAG/commit/135bc9056e9ecd800c1abe2f2ce24d1a86622a54
github.com/HKUDS/LightRAG/pull/3424
github.com/HKUDS/LightRAG/releases/tag/v1.5.5
github.com/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx
github.com/advisories/GHSA-frch-4w6v-q5xx
nvd.nist.gov/vuln/detail/CVE-2026-85734

Code Behaviors & Features

Detect and mitigate CVE-2026-85734 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →