CVE-2026-85725
Deferred Deferred - Pending Action

Timing Attack in LightRAG Password Comparison

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query the /login endpoint and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path. This issue is fixed in version 1.5.5.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-85725
EUVD
EUVD-2026-84546

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
hkuds lightrag to 1.5.5 (exc)
lightrag lightrag 1.5.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-208 Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-85725 is a timing side-channel vulnerability in LightRAG versions before 1.5.5. It occurs when plaintext passwords stored in AUTH_ACCOUNTS are compared using Python's == operator, which short-circuits at the first mismatching byte. This creates response-time differences that leak password length and content, allowing attackers to recover passwords character by character through repeated login attempts.

Detection Guidance

To detect this vulnerability, check if your LightRAG version is <= 1.5.4 by running: pip show lightrag. If installed, verify the vulnerable file exists at lightrag/api/passwords.py. Monitor login endpoint response times for timing discrepancies using tools like curl or Wireshark to observe variations in response times during authentication attempts.

Impact Analysis

An attacker with low-latency network access could exploit this to recover plaintext passwords by measuring response times to the /login endpoint. This bypasses brute-force protections and allows unauthorized account access. The vulnerability only affects deployments using unhashed passwords; bcrypt-prefixed passwords are not impacted.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. The timing side-channel exposes plaintext passwords, compromising data protection measures required by these regulations.

Mitigation Strategies

Upgrade LightRAG to version 1.5.5 or later using pip install --upgrade lightrag. If plaintext passwords are used, migrate to bcrypt-hashed passwords immediately. Ensure all password comparisons use constant-time methods like hmac.compare_digest. Review authentication logic to eliminate timing differences for valid vs invalid usernames.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85725. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart