https://vulnerability.circl.lu/sightings/feed 2026-09-24T20:39:37.297033+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/89252ad5-db15-4256-9455-75243b157f71/export 2026-09-24T20:39:37.322065+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "89252ad5-db15-4256-9455-75243b157f71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85734", "type": "seen", "source": "https://gist.github.com/alon710/7b1d3264d9c8eccf7d44ef50bef96c32", "content": "# CVE-2026-85734: CVE-2026-85734: Brute-Force and CPU-Exhaustion DoS in LightRAG API /login Endpoint\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85734\n\n## Summary\nLightRAG prior to version 1.5.5 does not implement rate limiting, lockout mechanisms, or throttling on its `/login` authentication endpoint. This allows unauthenticated remote attackers to perform rapid brute-force attacks to crack passwords and hijack active sessions. Furthermore, because the endpoint processed synchronous bcrypt verifications inside an asynchronous event loop, concurrent brute-force requests can easily exhaust server CPU resources, triggering an unauthenticated Denial of Service (DoS).\n\n## TL;DR\nUnauthenticated remote attackers can execute high-speed brute-force attacks against LightRAG's /login endpoint to compromise administrative credentials, or concurrently flood the endpoint to exhaust CPU resources and cause a Denial of Service due to a lack of rate limiting and thread-blocking bcrypt executions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-307: Improper Restriction of Excessive Authentication Attempts\n- **Attack Vector**: Network\n- **CVSS Score**: 9.1 (Critical)\n- **Impact**: Account Takeover and CPU-Exhaustion DoS\n- **Exploit Status**: PoC available, easily automatable\n- **CISA KEV Status**: No\n\n## Affected Systems\n\n- LightRAG API Server\n- **LightRAG**: < 1.5.5 (Fixed in: `1.5.5`)\n\n## Mitigation\n\n- Upgrade LightRAG instances to version 1.5.5 or later.\n- Ensure environment variables LOGIN_MAX_FAILED_ATTEMPTS and LOGIN_LOCKOUT_WINDOW_SECONDS are active and configured with restrictive thresholds.\n- Deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the API server to implement centralized, persistent rate limits.\n- Restrict network access to the API server's login endpoint to authorized IP ranges via firewall rules or VPNs.\n\n**Remediation Steps:**\n1. Identify all deployed LightRAG container or application environments.\n2. Modify the application configuration, or pull the latest container image corresponding to version v1.5.5 or above.\n3. Configure environment variables in your deployment manifest: LOGIN_MAX_FAILED_ATTEMPTS=5 and LOGIN_LOCKOUT_WINDOW_SECONDS=300.\n4. Restart the API server service to apply the rate limiter configurations.\n5. Validate the fix by sending multiple incorrect logins and verifying that HTTP 429 is received on the 6th attempt.\n\n## References\n\n- [GHSA-frch-4w6v-q5xx](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx)\n- [LightRAG Pull Request 3424](https://github.com/HKUDS/LightRAG/pull/3424)\n- [Fix Commit 135bc90](https://github.com/HKUDS/LightRAG/commit/135bc9056e9ecd800c1abe2f2ce24d1a86622a54)\n- [LightRAG Release v1.5.5](https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5)\n- [NVD CVE-2026-85734 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-85734)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85734) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T10:06:23.237822Z"} 2026-09-23T10:06:23.237822+00:00 https://vulnerability.circl.lu/sighting/44c0b58c-8243-41be-95cd-259c6e1eaaf7/export 2026-09-24T20:39:37.325574+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "44c0b58c-8243-41be-95cd-259c6e1eaaf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85734", "type": "published-proof-of-concept", "source": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-frch-4w6v-q5xx", "content": "", "creation_timestamp": "2026-09-22T22:35:18.250872Z"} 2026-09-22T22:35:18.250872+00:00 https://vulnerability.circl.lu/sighting/1fdae83a-9fae-4c15-8759-550aa9aae384/export 2026-09-24T20:39:37.326435+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "1fdae83a-9fae-4c15-8759-550aa9aae384", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85734", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mw4t4gjuc72y", "content": "\ud83d\udea8 CVE-2026-85734 \u2014 CVSS 9.1 CRITICAL\n\nLightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-85734\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-22T18:09:33.817944Z"} 2026-09-22T18:09:33.817944+00:00 https://vulnerability.circl.lu/sighting/59e52d7e-17c0-452c-912f-5685e24f54a9/export 2026-09-24T20:39:37.326530+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "59e52d7e-17c0-452c-912f-5685e24f54a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85734", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mw4qvv4o7g2p", "content": "CVE-2026-85734 - lightrag\nThe LightRAG version before 1.5.5 lets anyone try passwords on the /login page without any slowdown or lockout. This means an attacker can keep guessing until they find a correct\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#lightrag #hkuds #CVE #infosec", "creation_timestamp": "2026-09-22T17:30:07.076083Z"} 2026-09-22T17:30:07.076083+00:00