CVE-2026-85734: lightrag-hku Brute-Force Vulnerability Due to Lack of Rate Limiting on /login Endpoint
Summary
CVE-2026-85734: lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks. Affects lightrag-hku versions < 1.5.5. Fixed in 1.5.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
lightrag-hku is an open-source package designed for building lightweight web applications. It provides a simple interface for user authentication and session management. However, the package has a critical vulnerability in its /login endpoint, which lacks essential security measures such as rate limiting, allowing attackers to perform brute-force attacks without any restrictions.
Vulnerability Detail
The vulnerability arises from the absence of rate limiting, account lockout, or any delay on failed login attempts at the /login endpoint. This flaw enables attackers to submit an unlimited number of password guesses at full network speed, significantly increasing the risk of unauthorized access. The lack of protective measures means that any network-reachable attacker can exploit this vulnerability to brute-force user passwords, potentially gaining full access to sensitive data and administrative functions.
How To Fix
Latest published version: 1.5.7 as of 23 Oct 2026
pip install --upgrade "lightrag-hku==1.5.7"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.5.5
This is the first release that contains the fix.
pip install --upgrade "lightrag-hku==1.5.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing a reverse proxy or web application firewall that can enforce rate limiting on the /login endpoint. Additionally, you can manually introduce a delay in the login function to slow down the rate of login attempts.
Conclusion
The lightrag-hku package has a critical vulnerability that allows brute-force attacks on the /login endpoint due to the lack of rate limiting. It is essential to update to the patched version and implement additional security measures to protect against potential exploits.
See every vulnerability recorded for lightrag-hku →
FAQ
CVE-2026-85734 is a critical vulnerability in the lightrag-hku package that allows attackers to perform brute-force attacks on the /login endpoint due to the lack of rate limiting.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
If exploited, this vulnerability can lead to unauthorized access to user accounts, sensitive data, and administrative functionalities, posing a significant security risk.
To secure your application, update the lightrag-hku package to version 1.5.5 or later, and consider implementing additional security measures such as rate limiting and account lockout.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for lightrag-hku.
