CVE-2020-26214: Alerta LDAP authentication bypass via empty password

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or user interaction required, and a high EPSS score make this a top remediation target despite no KEV listing.

What it is

Alerta before 8.1.0 can accept an empty password during LDAP authentication, letting a client authenticate without valid credentials. This only affects deployments whose LDAP servers permit unauthenticated bind requests for anonymous authorization, and it matters because it defeats the authentication gate on the Alerta server.

Impact

An attacker gains authenticated access to the Alerta server without knowing any password, exposing alert data and any actions available to the authenticated role.

Attack surface

Reachable over the network through the Alerta authentication endpoint when LDAP is the configured authorization provider; no prior authentication is required, and the attacker only submits an empty password field.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is high at 0.659 (99.2nd percentile), indicating elevated likelihood of attempted exploitation.

What to do

• Upgrade Alerta to 8.1.0 or later, which returns HTTP 401 for authentication attempts with an empty password.
• If immediate upgrade is not possible, configure LDAP servers to reject unauthenticated bind requests from clients.
• Audit LDAP configuration for anonymous or unauthenticated bind support and disable it where not required.
• Review Alerta authentication logs for successful logins with empty or missing passwords.

Detection

• Search Alerta server logs for successful authentication events where the password field is empty or absent.
• Monitor LDAP server logs for unauthenticated bind requests originating from Alerta hosts.
• Alert on HTTP 200 responses from the Alerta login endpoint for requests with empty password parameters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.