CVE-2026-85725 HKUDS CVE debrief

Who should care

Defenders responsible for LightRAG deployments, particularly those using plaintext-configured passwords, should assess exposure and take immediate action to mitigate this vulnerability.

Why it matters

CVE-2026-85725 is a timing oracle vulnerability in LightRAG's password verification process. Defenders should prioritize verifying their deployments and upgrading to version 1.5.5 or later to mitigate this vulnerability. Those using plaintext-configured passwords are at risk of password recovery by attackers. The vulnerability allows for character-by-character password recovery through repeated /login endpoint queries. Deployments using bcrypt-prefixed password values are not affected.

• Password recovery by attackers through timing oracle exploitation
• Potential for lateral movement and unauthorized access
• Need for verification of LightRAG deployment versions and configurations
• Priority for upgrading to version 1.5.5 or later

Technical summary

The vulnerability exists in the verify_password function in lightrag/api/passwords.py, where plaintext AUTH_ACCOUNTS password values are compared using Python's == operator. This comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. An attacker with sufficiently low-latency access can exploit this to recover a plaintext-configured password character by character by repeatedly querying the /login endpoint.

Defensive priority

Defenders should prioritize verifying their LightRAG deployments and upgrading to version 1.5.5 or later to mitigate this vulnerability. Specifically, those using plaintext-configured passwords should assess exposure and take immediate action.

Recommended defensive actions

• Verify LightRAG deployment version and assess exposure to plaintext-configured passwords
• Upgrade to version 1.5.5 or later
• Review and adjust password configuration and authentication mechanisms
• Perform an inventory of assets using LightRAG to identify potential exposure
• Monitor for suspicious login attempts or anomalies in authentication logs
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure thorough mitigation

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, its impact, and the fixed version. Additional details are available in the source references, including GitHub commits, pull requests, and security advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.