CVE-2026-85725 Details
Description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query the /login endpoint and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path. This issue is fixed in version 1.5.5.
A vulnerability exists in LightRAG versions prior to 1.5.5, where the password verification function for plaintext AUTH_ACCOUNTS passwords uses Python's equality operator. This method can be exploited by a network attacker with low-latency access, who can measure response times to infer password characters one by one. The vulnerability arises because the comparison can exit after the first mismatched byte, creating a timing discrepancy that reveals information about the password's length and content. This issue does not affect deployments that use bcrypt-prefixed password values.
Users should update to LightRAG version 1.5.5 or later, where this vulnerability has been fixed. Instructions for updating can be found in the LightRAG repository on GitHub.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/HKUDS/LightRAG/commit/89849c3ed0e0380345a6b5bade027cfb9a5bf32c | [email protected] | Source CodeVendor |
| https://github.com/HKUDS/LightRAG/pull/3423 | [email protected] | Issue TrackingVendor |
| https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5 | [email protected] | Release NotesVendor |
| https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-208 | Observable Timing Discrepancy | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LightRAG | <= 1.5.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 26, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | [email protected] |