CVE-2026-85725

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query the /login endpoint and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path. This issue is fixed in version 1.5.5.

• CWE-208

• https://github.com/HKUDS/LightRAG/commit/89849c3ed0e0380345a6b5bade027cfb9a5bf32c
• https://github.com/HKUDS/LightRAG/pull/3423
• https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq
• https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq

Published

Sep 22, 2026

Last Modified

Sep 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85718The AsyncHttpClient (AHC) library allows Java applications t…5.9
• CVE-2026-85719The AsyncHttpClient (AHC) library allows Java applications t…7.5
• CVE-2026-8572Insufficient policy enforcement in Network in Google Chrome …3.1
• CVE-2026-85720The AsyncHttpClient (AHC) library allows Java applications t…5.9
• CVE-2026-85721The AsyncHttpClient (AHC) library allows Java applications t…7.5
• CVE-2026-85724Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…9.6
• CVE-2026-8573Integer overflow in Codecs in Google Chrome on Windows prior…8.3
• CVE-2026-85730smol-toml is a small, fast, and correct TOML parser and seri…8.2
• CVE-2026-85731oras-go is a Go library for managing OCI artifacts. Prior to…8.8
• CVE-2026-85732oras-go is a Go library for managing OCI artifacts. Prior to…4.7
• CVE-2026-85734LightRAG provides simple and fast retrieval-augmented genera…9.1
• CVE-2026-85738TREK is a collaborative travel planner. Prior to 3.4.0, the …6.3