Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query the /login endpoint and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path. This issue is fixed in version 1.5.5.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🟠 LightRAG, Observable Timing Discrepancy, #CVE-2026-85725 (Medium) -DC-Sep2026-2530 https://dailycve.com/lightrag-observable-timing-discrepancy-cve-2026-85725-medium-dc-sep2026-2530/
Post summary
The tweet discloses a new CVE‑2026-85725 affecting LightRAG, describing it as an observable timing discrepancy with medium severity, but provides no PoC, exploit, patch, or evidence of active exploitation.