CVE-2026-85734: CVE-2026-85734: Brute-Force and CPU-Exhaustion DoS in LightRAG API /login Endpoint

#security #cve #cybersecurity

CVE-2026-85734: Brute-Force and CPU-Exhaustion DoS in LightRAG API /login Endpoint

Vulnerability ID: CVE-2026-85734
CVSS Score: 9.1
Published: 2026-09-22

LightRAG prior to version 1.5.5 does not implement rate limiting, lockout mechanisms, or throttling on its /login authentication endpoint. This allows unauthenticated remote attackers to perform rapid brute-force attacks to crack passwords and hijack active sessions. Furthermore, because the endpoint processed synchronous bcrypt verifications inside an asynchronous event loop, concurrent brute-force requests can easily exhaust server CPU resources, triggering an unauthenticated Denial of Service (DoS).

TL;DR

Unauthenticated remote attackers can execute high-speed brute-force attacks against LightRAG's /login endpoint to compromise administrative credentials, or concurrently flood the endpoint to exhaust CPU resources and cause a Denial of Service due to a lack of rate limiting and thread-blocking bcrypt executions.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-307: Improper Restriction of Excessive Authentication Attempts
Attack Vector: Network
CVSS Score: 9.1 (Critical)
Impact: Account Takeover and CPU-Exhaustion DoS
Exploit Status: PoC available, easily automatable
CISA KEV Status: No

Affected Systems

LightRAG API Server
LightRAG: < 1.5.5 (Fixed in: 1.5.5)

Code Analysis

Commit: 135bc90

Fix login brute-force vulnerability (CWE-307) and CPU-bound event-loop starvation by implementing an in-process sliding-window rate limiter and moving bcrypt verifications to an asynchronous worker thread.

Exploit Details

GitHub: Vulnerability verification detailed inside the official GHSA security advisory.

Mitigation Strategies

Upgrade LightRAG instances to version 1.5.5 or later.
Ensure environment variables LOGIN_MAX_FAILED_ATTEMPTS and LOGIN_LOCKOUT_WINDOW_SECONDS are active and configured with restrictive thresholds.
Deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the API server to implement centralized, persistent rate limits.
Restrict network access to the API server's login endpoint to authorized IP ranges via firewall rules or VPNs.

Remediation Steps:

Identify all deployed LightRAG container or application environments.
Modify the application configuration, or pull the latest container image corresponding to version v1.5.5 or above.
Configure environment variables in your deployment manifest: LOGIN_MAX_FAILED_ATTEMPTS=5 and LOGIN_LOCKOUT_WINDOW_SECONDS=300.
Restart the API server service to apply the rate limiter configurations.
Validate the fix by sending multiple incorrect logins and verifying that HTTP 429 is received on the 6th attempt.

References

Read the full report for CVE-2026-85734 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community