CVE-2020-26214 in the critical feed json
LDAP authentication bypass in Alerta
published 6y ago modified 4mo ago also GHSA-5hmm-x8q8-w5jh , PYSEC-2020-159 , EUVD-2020-0001
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 65.9%
- EPSS 65.9% chance of exploitation in 30 days, percentile 99.2%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.
Patch / fix
- pypi alerta-server 7.5.7, 8.1.0
- alerta_project alerta 7.5.7, 8.1.0
- github.com/alerta/alerta@2bfa317 commit
- github.com/alerta/alerta#1345 pull request
Is CVE-2020-26214 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
65.93% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Nuclei template Alerta < 8.1.0 - Authentication Bypass nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | alerta-server | >=8.0.0, <8.1.0 <7.5.7 |
8.1.0 7.5.7 |
Affected products
- alerta alerta
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/alerta/alerta/pull/1345
web, third-party-advisory
-
github.com
/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65
web, patch, third-party-advisory
-
github.com
/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh
web, third-party-advisory, advisory
-
github.com
/alerta/alerta/issues/1277
web, third-party-advisory, report
-
pypi.org
/project/alerta-server/8.1.0/
third-party-advisory, package
-
tools.ietf.org
/html/rfc4513#section-5.1.2
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2020-26214
advisory
-
github.com
/alerta/alerta
package
-
github.com
/pypa/advisory-database/tree/main/vulns/alerta-server/PYSEC-2020-159.yaml
web
-
pypi.org
/project/alerta-server/8.1.0
web
Sources
- CVE List CVE-2020-26214
- GitHub Advisory GHSA-5hmm-x8q8-w5jh
- NVD CVE-2020-26214
- OSV PYSEC-2020-159
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.