cyfenced.com →

[ CVE-2026-85725 · Published 22 Sep 2026 ]

lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

CVSS 5.9 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query the /login endpoint and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path. This issue is fixed in version 1.5.5.

[ Fixes ]Fixes and patches

  • lightrag-hku 1.5.5Fixed version · GitHub Advisories · pip package lightrag-hku: upgrade to 1.5.5 or later (affected <= 1.5.4)

[ Packages ]Affected open-source packages

[ References ]References