CVE-2026-85725: LightRAG Timing Attack Vulnerability

CVE-2026-85725 Overview

CVE-2026-85725 is a timing side-channel vulnerability in LightRAG, an open-source retrieval-augmented generation framework maintained by HKUDS. Versions prior to 1.5.5 compare plaintext AUTH_ACCOUNTS password values using Python's == operator inside the verify_password function in lightrag/api/passwords.py. The comparison short-circuits at the first mismatching byte, producing measurable response-time differences that vary with password length and matching prefix. A network attacker with low-latency access to the /login endpoint can use this timing oracle to recover plaintext passwords character by character. Deployments configured with bcrypt-prefixed password values do not traverse the vulnerable comparison path. The issue is fixed in version 1.5.5 [CWE-208].

Critical Impact
Remote unauthenticated attackers can recover plaintext administrator passwords from LightRAG deployments through repeated login timing measurements, leading to full authentication bypass.

Affected Products

LightRAG versions prior to 1.5.5
Deployments using plaintext AUTH_ACCOUNTS entries (bcrypt-prefixed values are not affected)
LightRAG API server exposing the /login endpoint

Discovery Timeline

2026-09-22 - CVE-2026-85725 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-85725

Vulnerability Analysis

The vulnerability resides in the verify_password function within lightrag/api/passwords.py. LightRAG supports two credential storage modes: bcrypt-hashed values prefixed with {bcrypt}, and plaintext strings supplied through the AUTH_ACCOUNTS environment variable. When credentials are stored in plaintext, the function performs equality checking with Python's native == string operator.

Python's string equality returns as soon as it encounters a mismatching byte. This produces observable timing differences correlated with the number of matching leading characters. An attacker submitting authentication attempts to /login can measure response latency across many trials and statistically infer each byte of the password.

Because the attack requires only network access and no prior credentials, and because the disclosed material is the administrator password itself, successful exploitation grants full API access.

Root Cause

The root cause is the use of a non-constant-time string comparison for a secret value. The == operator on str objects in CPython optimizes for the common case by comparing byte-by-byte and returning early on the first difference. When applied to security-sensitive comparisons, this optimization leaks information through the process's execution time.

Attack Vector

An unauthenticated remote attacker repeatedly POSTs candidate passwords to the /login endpoint. By collecting large samples of response latencies and correlating them with candidate prefixes, the attacker identifies which prefix yields marginally longer processing time. The attack extends the recovered prefix one byte at a time until the full password is disclosed. Low network jitter, or co-location with the target, materially improves the oracle's reliability.

python

# Security patch in lightrag/api/passwords.py
# fix(auth): constant-time plaintext password comparison (GHSA-c759-cx9p-mrwq)
+import hmac
+
 import bcrypt

 BCRYPT_PASSWORD_PREFIX = "{bcrypt}"

Source: GitHub Commit 89849c3

The patch introduces hmac.compare_digest for the plaintext comparison path, which is designed to run in time dependent only on the length of the inputs and not on their contents.

python

# Companion patch in lightrag/api/auth.py adds a dummy bcrypt spec
# to equalize timing for unknown-username lookups.
+from .passwords import BCRYPT_PASSWORD_PREFIX, verify_password
+
+_DUMMY_VERIFY_SPEC = (
+    BCRYPT_PASSWORD_PREFIX
+    + "$2b$12$ilI0sY2jGfy4h0AVtn6WuutU6BFwzZq5MVvrQYY9fbyQ59NI2NBKa"
+)

Source: GitHub Commit 89849c3

Detection Methods for CVE-2026-85725

Indicators of Compromise

Large volumes of failed POST /login requests from a single source or small IP range within short time windows.
Sequential login attempts where submitted passwords share progressively longer common prefixes.
Successful authentication from a client that previously generated thousands of failed attempts.
LightRAG API access logs showing unusual client-side latency measurement patterns such as rapid, evenly spaced requests.

Detection Strategies

Alert on authentication failure rates exceeding baseline thresholds against the LightRAG /login endpoint.
Correlate failed login bursts with subsequent administrative API activity from the same origin.
Inspect reverse proxy or WAF logs for repeated /login POSTs lacking legitimate User-Agent or session cookies.

Monitoring Recommendations

Enable structured logging on the LightRAG API server and forward events to a centralized log platform for retention and query.
Track per-source request rates to /login and generate alerts when thresholds are exceeded.
Monitor for outbound data transfers immediately following successful authentication events on previously abused accounts.

How to Mitigate CVE-2026-85725

Immediate Actions Required

Upgrade LightRAG to version 1.5.5 or later, which replaces the vulnerable comparison with hmac.compare_digest.
Rotate all passwords configured in AUTH_ACCOUNTS after upgrading, as prior values may already be compromised.
Convert any remaining plaintext AUTH_ACCOUNTS entries to bcrypt-prefixed values using the {bcrypt} scheme.
Restrict network exposure of the LightRAG API to trusted networks or place it behind an authenticated reverse proxy.

Patch Information

The fix is available in LightRAG v1.5.5. Technical details are documented in GitHub Security Advisory GHSA-c759-cx9p-mrwq and Pull Request #3423. The remediation introduces hmac.compare_digest for plaintext comparison and adds a dummy bcrypt verification spec to equalize timing for unknown-username lookups.

Workarounds

Configure all AUTH_ACCOUNTS credentials using the {bcrypt} prefix, which bypasses the vulnerable plaintext comparison path entirely.
Deploy rate limiting on the /login endpoint at the reverse proxy or WAF layer to reduce the feasibility of timing measurements.
Restrict access to the LightRAG API using network-level controls such as IP allowlists, VPN gateways, or mutual TLS.

bash

# Example bcrypt-prefixed AUTH_ACCOUNTS configuration to avoid the vulnerable path
AUTH_ACCOUNTS="admin:{bcrypt}$2b$12$ilI0sY2jGfy4h0AVtn6WuutU6BFwzZq5MVvrQYY9fbyQ59NI2NBKa"