CVE-2026-85725: Observable Timing Side-Channel Vulnerability in HKUDS LightRAG

Vulnerability ID: CVE-2026-85725
CVSS Score: 5.9
Published: 2026-09-22

HKUDS LightRAG prior to version 1.5.5 is vulnerable to multiple timing side-channels (CWE-208) in its API authentication layer. The password verification logic in lightrag/api/passwords.py compares plaintext administrative credentials using Python's short-circuiting equality operator (==). Additionally, lightrag/api/auth.py terminates authentication early on non-existent usernames, creating an observable latency difference compared to computationally expensive bcrypt comparisons on valid accounts. Together, these allow remote unauthenticated attackers with low-latency network access to enumerate valid usernames and extract plaintext passwords character by character.

TL;DR

Unauthenticated remote timing side-channels in HKUDS LightRAG authentication logic permit username enumeration and plaintext password recovery.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-208: Observable Timing Discrepancy
• Attack Vector: Network (Low-latency / High-precision)
• CVSS v3.1: 5.9 (Medium)
• Exploit Status: Proof-of-Concept
• KEV Status: Not Listed
• Impact: Administrative Credential Recovery & Username Enumeration

Affected Systems

• HKUDS LightRAG
• LightRAG: < 1.5.5 (Fixed in: 1.5.5)

Code Analysis

Commit: 89849c3

Unify verify_password comparison and add dummy verification for unknown accounts to resolve timing side-channels

Mitigation Strategies

• Upgrade HKUDS LightRAG deployments to version 1.5.5 or higher.
• Store administrative credentials as bcrypt-hashed strings instead of plaintext values.
• Configure web application firewalls (WAF) or rate-limiters to restrict rapid, automated attempts on the /login endpoint.

Remediation Steps:

1. Update dependencies in requirements.txt or pip configurations to pin LightRAG to version 1.5.5 or above.
2. Locate the administrative credential configurations inside the environment or config files.
3. Generate a bcrypt hash of the administrative password.
4. Format the credentials using the {bcrypt} prefix, for example: AUTH_ACCOUNTS=admin:{bcrypt}$2b$12$....
5. Restart the LightRAG service to apply the secure configurations.

References

• GitHub Security Advisory GHSA-c759-cx9p-mrwq
• HKUDS LightRAG Official Pull Request 3423
• HKUDS LightRAG Release Version v1.5.5
• NVD Record for CVE-2026-85725

Read the full report for CVE-2026-85725 on our website for more details including interactive diagrams and full exploit analysis.