Authentication Bypass in LightRAG via Brute Force

Executive Summary

This vulnerability is a brute-force attack flaw in LightRAG versions before 1.5.5. The /login endpoint lacks rate limiting, allowing attackers to submit unlimited password guesses rapidly. This enables them to guess credentials and gain unauthorized access to accounts, documents, knowledge graphs, and administrative functions.

Useful 0 Not Useful 0

Detection Guidance

Monitor for repeated failed login attempts to the /login endpoint. Use tools like curl to test the endpoint for rate limiting. Example: curl -X POST -d '{"username":"test","password":"guess"}' http://target/lightrag/api/lightrag_server.py/login. Check server logs for HTTP 429 responses or excessive 401 errors.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain full authenticated access to your LightRAG instance, compromising sensitive data like documents and knowledge graphs. They could also perform administrative actions if they guess credentials successfully.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in non-compliance due to insufficient access controls and breach notification obligations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade LightRAG to version 1.5.5 or later. If upgrading is not possible, implement a rate limiter or WAF rules to restrict login attempts. Block IPs showing brute-force patterns. Temporarily disable the login endpoint if under active attack.

Useful 0 Not Useful 0