CVE-2020-26214: Authentication Bypass in Alerta Server

The primary impact of CVE-2020-26214 is unauthorized access to the Alerta Server. An attacker who can bypass LDAP authentication can gain access to sensitive data and potentially compromise the entire system. This could involve modifying alert configurations, creating or deleting users, and disrupting monitoring operations. The vulnerability is particularly concerning because it leverages a misconfiguration on the LDAP server side, rather than a flaw within Alerta Server itself. Exploitation requires the LDAP server to be configured to allow unauthenticated binds, a common default setting on Active Directory installations.

1. Reserved2020-10-01
2. Published2020-11-06
3. Modified2026-03-13
4. EPSS updated2026-04-02

The primary mitigation for CVE-2020-26214 is to upgrade Alerta Server to version 8.1.0 or later, which includes a fix that returns an HTTP 401 Unauthorized response for empty password authentication attempts. If upgrading is not immediately feasible, LDAP administrators can implement a workaround by disallowing unauthenticated bind requests from clients. This can be configured within the LDAP server itself. Monitor LDAP logs for unusual authentication attempts, particularly those with empty passwords. After upgrading, confirm the fix by attempting authentication with an empty password and verifying that it results in a 401 Unauthorized response.