DailyCVE@dailycve
🟠 LightRAG, Observable Timing Discrepancy, #CVE-2026-85725 (Medium) -DC-Sep2026-2530 https://dailycve.com/lightrag-observable-timing-discrepancy-cve-2026-85725-medium-dc-sep2026-2530/
0000020
236 followersView on X
CVE-2026-85725
LOWCVSS 5.9 · MEDIUMSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query the /login endpoint and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path. This issue is fixed in version 1.5.5.
0.0/ 10 priority
Sources & remediation
Other references
Weakness type (CWE)
CWE-208
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day