CVE-2026-85725: medium-severity vulnerability in HKUDS LightRAG
LightRAG: Plaintext Passwords Compared Without Constant-Time Function
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.9epss 0.4%
LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, verify_password in lightrag/api/passwords.py compares plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query the /login endpoint and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path. This issue is fixed in version 1.5.5.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
HKUDS · LightRAGRelated CVEs — HKUDS LightRAG
In the same product, most dangerous first.
CVE-2026-61808CRITICALLightRAG: Missing Authentication for Critical API Functions in Default ConfigurationEPSS 2.5%CVE-2026-61736CRITICALLightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed RequestsEPSS 1.4%CVE-2026-85734CRITICALLightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksEPSS 0.6%CVE-2026-61740CRITICALLightRAG: Authentication bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionEPSS 0.5%CVE-2026-85709MEDIUMLightRAG: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesEPSS 0.4%CVE-2026-86062MEDIUMLightRAG: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested contentEPSS 0.3%