CVE-2026-85734

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5

Description The 'POST /login' endpoint in lightrag/api/lightrag server.py does not implement rate limiting, account lockout, delays, or counters for failed authentication attempts. This allows a network attacker to perform brute-force attacks by submitting password guesses at full request speed. Successful recovery of credentials provides authenticated access to documents, the knowledge graph, and administrative operations.

Recommendations Update to version 1.5.5.