LDAP authentication bypass in Alerta
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| alerta | alerta | before 8.1.0 | 8.1.0 | Patch available | CNA |
| — | alerta-server (PyPI) | 8.0.0 to before 8.1.0 | 8.1.0 | Patch available | GHSA-5hmm-x8q8-w5jh |
| — | alerta-server (PyPI) | before 7.5.7 | 7.5.7 | Patch available | GHSA-5hmm-x8q8-w5jh |
- alerta Vendoralerta Affected before 8.1.0 Fixed in 8.1.0 Patch available CNA
- alerta-server (PyPI) Vendor— Affected 8.0.0 to before 8.1.0 Fixed in 8.1.0 Patch available GHSA-5hmm-x8q8-w5jh
- alerta-server (PyPI) Vendor— Affected before 7.5.7 Fixed in 7.5.7 Patch available GHSA-5hmm-x8q8-w5jh
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:* | before 7.5.7; 8.0.0 to before 8.1.0 | Vulnerable | Alerta Project |
- cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:* Versions before 7.5.7; 8.0.0 to before 8.1.0 Vulnerable ·Alerta Project
Remediation
- Fix · CNA alerta (alerta) Fixed in 8.1.0
- Fix · GHSA-5hmm-x8q8-w5jh alerta-server (PyPI) Fixed in 8.1.0 Advisory →
- Fix · GHSA-5hmm-x8q8-w5jh alerta-server (PyPI) Fixed in 7.5.7 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-26214
- 2026-10-03 Alias added: GHSA-5hmm-x8q8-w5jh
References
Advisory 6
More Alerta Project Alerta vulnerabilities
- TI-2026-26686 alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API CVSS 4.0MEDIUM 6.9
Sources
- CVE-2020-26214 · CVE Program
- CVE-2020-26214 · NVD
- FIRST EPSS
- GHSA-5hmm-x8q8-w5jh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences