{"metadata": {"vulnerability": "CVE-2026-85725", "count": 16, "kinds": {"milestone": 5, "sighting": 2, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-04T14:45:10.648Z", "date_only": false, "value": "2026-09-04T14:45:10.648Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-85725", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-22T16:16:36.326Z", "date_only": false, "value": "2026-09-22T16:16:36.326Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-85725", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-22T16:16:36.326Z", "date_only": false, "value": "2026-09-22T16:16:36.326Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-85725", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-22T17:17:27Z", "date_only": false, "value": "2026-09-22T17:17:27Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C759-CX9P-MRWQ", "record": "GHSA-C759-CX9P-MRWQ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-22T17:17:27.203Z", "date_only": false, "value": "2026-09-22T17:17:27.203", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85725", "record": "FKIE_CVE-2026-85725", "field": "published"}, {"timestamp": "2026-09-22T20:40:19Z", "date_only": false, "value": "2026-09-22T20:40:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C759-CX9P-MRWQ", "record": "GHSA-C759-CX9P-MRWQ", "field": "published"}, {"timestamp": "2026-09-22T20:40:20Z", "date_only": false, "value": "2026-09-22T20:40:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C759-CX9P-MRWQ", "record": "GHSA-C759-CX9P-MRWQ", "field": "modified"}, {"timestamp": "2026-09-22T22:35:20.107Z", "date_only": false, "value": "2026-09-22T22:35:20.107115Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq", "record": "CVE-2026-85725", "field": "creation_timestamp", "uuid": "f060b556-b96b-4853-b48d-2a0f7f3b0e1c", "url": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq"}, {"timestamp": "2026-09-23T10:32:03.678Z", "date_only": false, "value": "2026-09-23T10:32:03.678163Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/0d3b32340b0e22813aee7b5053c88ded", "record": "CVE-2026-85725", "field": "creation_timestamp", "uuid": "14961872-b4b1-40d5-807f-c3e81d8e160f", "content": "# CVE-2026-85725: CVE-2026-85725: Observable Timing Side-Channel Vulnerability in HKUDS LightRAG\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85725\n\n## Summary\nHKUDS LightRAG prior to version 1.5.5 is vulnerable to multiple timing side-channels (CWE-208) in its API authentication layer. The password verification logic in `lightrag/api/passwords.py` compares plaintext administrative credentials using Python's short-circuiting equality operator (`==`). Additionally, `lightrag/api/auth.py` terminates authentication early on non-existent usernames, creating an observable latency difference compared to computationally expensive bcrypt comparisons on valid accounts. Together, these allow remote unauthenticated attackers with low-latency network access to enumerate valid usernames and extract plaintext passwords character by character.\n\n## TL;DR\nUnauthenticated remote timing side-channels in HKUDS LightRAG authentication logic permit username enumeration and plaintext password recovery.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208: Observable Timing Discrepancy\n- **Attack Vector**: Network (Low-latency / High-precision)\n- **CVSS v3.1**: 5.9 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Administrative Credential Recovery & Username Enumeration\n\n## Affected Systems\n\n- HKUDS LightRAG\n- **LightRAG**: < 1.5.5 (Fixed in: `1.5.5`)\n\n## Mitigation\n\n- Upgrade HKUDS LightRAG deployments to version 1.5.5 or higher.\n- Store administrative credentials as bcrypt-hashed strings instead of plaintext values.\n- Configure web application firewalls (WAF) or rate-limiters to restrict rapid, automated attempts on the /login endpoint.\n\n**Remediation Steps:**\n1. Update dependencies in requirements.txt or pip configurations to pin LightRAG to version 1.5.5 or above.\n2. Locate the administrative credential configurations inside the environment or config files.\n3. Generate a bcrypt hash of the administrative password.\n4. Format the credentials using the `{bcrypt}` prefix, for example: `AUTH_ACCOUNTS=admin:{bcrypt}$2b$12$...`.\n5. Restart the LightRAG service to apply the secure configurations.\n\n## References\n\n- [GitHub Security Advisory GHSA-c759-cx9p-mrwq](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq)\n- [HKUDS LightRAG Official Pull Request 3423](https://github.com/HKUDS/LightRAG/pull/3423)\n- [HKUDS LightRAG Release Version v1.5.5](https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5)\n- [NVD Record for CVE-2026-85725](https://nvd.nist.gov/vuln/detail/CVE-2026-85725)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85725) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/0d3b32340b0e22813aee7b5053c88ded"}, {"timestamp": "2026-09-25T23:42:45.536Z", "date_only": false, "value": "2026-09-25T23:42:45.536883Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-85725", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-25T23:42:45.536Z", "date_only": false, "value": "2026-09-25T23:42:45.536883Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85725", "record": "FKIE_CVE-2026-85725", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-25T23:43:12.253Z", "date_only": false, "value": "2026-09-25T23:43:12.253Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-85725", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-25T23:43:12.253Z", "date_only": false, "value": "2026-09-25T23:43:12.253Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-85725", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-26T00:16:37.513Z", "date_only": false, "value": "2026-09-26T00:16:37.513", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-85725", "record": "FKIE_CVE-2026-85725", "field": "lastModified"}, {"timestamp": "2026-10-01T16:38:37.356Z", "date_only": false, "value": "2026-10-01T16:38:37.356906Z", "kind": "milestone", "label": "Published", "source": "pysec \u00b7 PYSEC-2026-4061", "record": "PYSEC-2026-4061", "field": "published"}, {"timestamp": "2026-10-01T17:10:27.189Z", "date_only": false, "value": "2026-10-01T17:10:27.189063Z", "kind": "other", "label": "Updated", "source": "pysec \u00b7 PYSEC-2026-4061", "record": "PYSEC-2026-4061", "field": "modified"}]}