Timing Oracle Vulnerability in LightRAG by HKUDS

CVE-2026-85725

What is CVE-2026-85725?

The vulnerability in LightRAG involves the 'verify_password' function, which uses Python's '==' operator for plaintext password comparison. This method can expose timing differences based on the length and prefix matches of the passwords. An attacker with low-latency access can exploit this characteristic by making multiple login requests, thereby retrieving the plaintext password one character at a time. Deployments utilizing bcrypt-prefixed passwords are not impacted, and the issue has been addressed in version 1.5.5.

References