CVE-2026-85734: LightRAG Authentication Bypass Vulnerability

CVE-2026-85734 Overview

CVE-2026-85734 is a missing brute-force protection vulnerability in LightRAG, an open-source retrieval-augmented generation framework maintained by HKUDS. Versions prior to 1.5.5 expose a POST /login endpoint in lightrag/api/lightrag_server.py that enforces no rate limit, account lockout, delay, or failure counter. A network attacker can submit password guesses at full request speed until a valid credential is discovered. Successful credential recovery grants authenticated access to stored documents, the knowledge graph, and administrative operations. The weakness maps to [CWE-307: Improper Restriction of Excessive Authentication Attempts]. The maintainers addressed the issue in LightRAG version 1.5.5.

Critical Impact
Unauthenticated attackers can brute-force valid credentials against POST /login at unrestricted speed and gain full administrative access to LightRAG data and knowledge graphs.

Affected Products

LightRAG (HKUDS) versions prior to 1.5.5
LightRAG API server component (lightrag/api/lightrag_server.py)
Deployments exposing the LightRAG POST /login endpoint to network clients

Discovery Timeline

2026-09-22 - CVE-2026-85734 published to NVD
2026-09-22 - Last updated in NVD database
Patch released - LightRAG v1.5.5 with fix in pull request #3424 and commit 135bc90

Technical Details for CVE-2026-85734

Vulnerability Analysis

LightRAG exposes an HTTP authentication endpoint at POST /login for issuing session tokens. Before version 1.5.5, the handler processed each credential submission without tracking prior failures. There was no per-IP counter, no per-username lockout, no exponential backoff, and no CAPTCHA. An attacker can therefore script parallel password guesses and iterate through wordlists at network line rate. Once a valid password is discovered, the returned token grants access to documents, the knowledge graph API, and administrative functions. The GitHub Security Advisory GHSA-frch-4w6v-q5xx confirms the scope and remediation.

Root Cause

The root cause is the absence of any throttling or lockout logic around failed authentication attempts, classified as [CWE-307]. The login handler validated credentials and returned success or failure, but never persisted or aggregated failure state. LightRAG relied on password strength alone, an assumption that fails against automated guessing when no rate limit exists at the application layer.

Attack Vector

Exploitation requires only network reachability to the LightRAG API server. An unauthenticated attacker sends repeated POST /login requests with candidate usernames and passwords. Because no throttling exists, the attacker's effective guess rate is bounded only by network bandwidth and server capacity. After discovering valid credentials, the attacker authenticates through the standard flow and interacts with the API as a legitimate user.

The patched configuration introduces two new environment variables that govern brute-force protection:

python

    args.token_auto_renew = get_env_value("TOKEN_AUTO_RENEW", True, bool)
    args.token_renew_threshold = get_env_value("TOKEN_RENEW_THRESHOLD", 0.5, float)

    # Login brute-force protection: max failed /login attempts per client IP +
    # username within the window before further attempts are rejected with HTTP
    # 429. Set LOGIN_MAX_FAILED_ATTEMPTS=0 to disable (CWE-307).
    args.login_max_failed_attempts = get_env_value("LOGIN_MAX_FAILED_ATTEMPTS", 5, int)
    args.login_lockout_window_seconds = get_env_value(
        "LOGIN_LOCKOUT_WINDOW_SECONDS", 300, float
    )

Source: LightRAG commit 135bc90 – lightrag/api/config.py

Detection Methods for CVE-2026-85734

Indicators of Compromise

High volume of POST /login requests from a single client IP within a short window against a LightRAG server
Repeated HTTP 401 or 403 responses from /login followed by an HTTP 200 issuing a token
Successful /login responses from IP addresses that are not part of expected administrator or automation ranges
Post-authentication access to knowledge graph or administrative endpoints from newly seen source IPs

Detection Strategies

Alert when the ratio of failed to successful POST /login requests per source IP exceeds a defined threshold in a rolling window
Correlate a burst of failed logins followed by a successful login from the same IP or user agent within minutes
Baseline normal /login request rates per deployment and flag statistical outliers

Monitoring Recommendations

Ingest LightRAG API access logs into a centralized logging or SIEM platform with retention sufficient for brute-force windows
Enable reverse-proxy or WAF logging in front of LightRAG to capture request rates independent of the application
Track authentication success following prolonged failure sequences and route those events to the SOC for review

How to Mitigate CVE-2026-85734

Immediate Actions Required

Upgrade LightRAG to version 1.5.5 or later from the official release page
Set LOGIN_MAX_FAILED_ATTEMPTS and LOGIN_LOCKOUT_WINDOW_SECONDS in the LightRAG environment configuration, keeping the defaults of 5 attempts per 300 seconds unless a stricter policy is required
Rotate all LightRAG account credentials and issued tokens if the server was exposed to untrusted networks before patching
Restrict network exposure of the LightRAG API to trusted client ranges through firewalls or private networking

Patch Information

The fix is delivered in LightRAG v1.5.5 via pull request #3424 and commit 135bc90. The patch adds per-IP and per-username failure tracking to POST /login, returning HTTP 429 once the configured threshold is exceeded within the lockout window. A successful login resets the counter. The advisory notes that counters are per server process; deployments using multiple Gunicorn workers should combine the application controls with a reverse-proxy or WAF rate limit for strict enforcement.

Workarounds

Place LightRAG behind a reverse proxy such as Nginx or an ingress controller and enforce a strict request rate on POST /login
Deploy a Web Application Firewall rule that limits authentication attempts per source IP and blocks abusive clients
Restrict /login access to a VPN, bastion network, or allowlisted IP ranges until the upgrade to 1.5.5 is complete
Enforce strong, unique passwords for all LightRAG accounts to reduce the success probability of automated guessing

bash

# Configuration example: enable login brute-force protection in LightRAG >= 1.5.5
# .env file for the LightRAG API server
LOGIN_MAX_FAILED_ATTEMPTS=5
LOGIN_LOCKOUT_WINDOW_SECONDS=300

Source: LightRAG commit 135bc90 – env.example