CVE-2026-126777 · Package
NO FIX YET · SEE WHAT TO DO
Traccar's LDAP login accepts an empty password and performs an unauthenticated LDAP bind, so anyone who knows a valid username gets a session. The session can belong to any account, including administrators.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Traccar installs with LDAP authentication enabled are exposed, and the directory must accept unauthenticated binds. Installs using only local accounts are not affected by this flaw. Anyone running a self-hosted Traccar server with LDAP login should check it first.
Not affected if authenticated-binds-only, ldap-disabled, managed-hosting
Who cares ldap, self-hosted, traccar
java -jar tracker-server.jar --version or the version shown in the web UI; versions from 3.15 up to but not including 6.17.0 are affectedtraccar.xml or the config for ldap.url or ldap. settings6.17.0 or laterTraccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.
This page as .md ·
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.