https://vulnerability.circl.lu/sightings/feed 2026-09-23T17:54:57.449604+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/14961872-b4b1-40d5-807f-c3e81d8e160f/export 2026-09-23T17:54:57.465925+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "14961872-b4b1-40d5-807f-c3e81d8e160f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-85725", "type": "seen", "source": "https://gist.github.com/alon710/0d3b32340b0e22813aee7b5053c88ded", "content": "# CVE-2026-85725: CVE-2026-85725: Observable Timing Side-Channel Vulnerability in HKUDS LightRAG\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-85725\n\n## Summary\nHKUDS LightRAG prior to version 1.5.5 is vulnerable to multiple timing side-channels (CWE-208) in its API authentication layer. The password verification logic in `lightrag/api/passwords.py` compares plaintext administrative credentials using Python's short-circuiting equality operator (`==`). Additionally, `lightrag/api/auth.py` terminates authentication early on non-existent usernames, creating an observable latency difference compared to computationally expensive bcrypt comparisons on valid accounts. Together, these allow remote unauthenticated attackers with low-latency network access to enumerate valid usernames and extract plaintext passwords character by character.\n\n## TL;DR\nUnauthenticated remote timing side-channels in HKUDS LightRAG authentication logic permit username enumeration and plaintext password recovery.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-208: Observable Timing Discrepancy\n- **Attack Vector**: Network (Low-latency / High-precision)\n- **CVSS v3.1**: 5.9 (Medium)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Impact**: Administrative Credential Recovery & Username Enumeration\n\n## Affected Systems\n\n- HKUDS LightRAG\n- **LightRAG**: < 1.5.5 (Fixed in: `1.5.5`)\n\n## Mitigation\n\n- Upgrade HKUDS LightRAG deployments to version 1.5.5 or higher.\n- Store administrative credentials as bcrypt-hashed strings instead of plaintext values.\n- Configure web application firewalls (WAF) or rate-limiters to restrict rapid, automated attempts on the /login endpoint.\n\n**Remediation Steps:**\n1. Update dependencies in requirements.txt or pip configurations to pin LightRAG to version 1.5.5 or above.\n2. Locate the administrative credential configurations inside the environment or config files.\n3. Generate a bcrypt hash of the administrative password.\n4. Format the credentials using the `{bcrypt}` prefix, for example: `AUTH_ACCOUNTS=admin:{bcrypt}$2b$12$...`.\n5. Restart the LightRAG service to apply the secure configurations.\n\n## References\n\n- [GitHub Security Advisory GHSA-c759-cx9p-mrwq](https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq)\n- [HKUDS LightRAG Official Pull Request 3423](https://github.com/HKUDS/LightRAG/pull/3423)\n- [HKUDS LightRAG Release Version v1.5.5](https://github.com/HKUDS/LightRAG/releases/tag/v1.5.5)\n- [NVD Record for CVE-2026-85725](https://nvd.nist.gov/vuln/detail/CVE-2026-85725)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-85725) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-23T10:32:03.678163Z"} 2026-09-23T10:32:03.678163+00:00 https://vulnerability.circl.lu/sighting/f060b556-b96b-4853-b48d-2a0f7f3b0e1c/export 2026-09-23T17:54:57.469493+00:00 Joseph Lee https://vulnerability.circl.lu/user/syspect {"uuid": "f060b556-b96b-4853-b48d-2a0f7f3b0e1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-85725", "type": "published-proof-of-concept", "source": "https://github.com/HKUDS/LightRAG/security/advisories/GHSA-c759-cx9p-mrwq", "content": "", "creation_timestamp": "2026-09-22T22:35:20.107115Z"} 2026-09-22T22:35:20.107115+00:00