---
id: "CVE-2026-126777"
page: "https://infrastack.ai/live/CVE-2026-126777"
kind: "vulnerability"
aliases: ["CVE-2026-126777"]
title: "Traccar: empty LDAP password logs in any known user, including admins"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ldap", "package", "self-hosted", "traccar"]
not_affected_if: ["authenticated-binds-only", "ldap-disabled", "managed-hosting"]
published_at: "2026-11-11T19:17:38+00:00"
first_seen_at: "2026-11-11T19:28:46+00:00"
updated_at: "2026-11-11T19:29:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126777", "first_seen_at": "2026-11-11T19:28:46+00:00"}]
exploit_sources: []
---

# Traccar: empty LDAP password logs in any known user, including admins

Link for people: https://infrastack.ai/live/CVE-2026-126777 (this .md is for agents)

Traccar's LDAP login accepts an empty password and performs an unauthenticated LDAP bind, so anyone who knows a valid username gets a session. The session can belong to any account, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Traccar version with `java -jar tracker-server.jar --version` or the version shown in the web UI; versions from 3.15 up to but not including `6.17.0` are affected
- Check whether LDAP is enabled in `traccar.xml` or the config for `ldap.url` or `ldap.` settings
- Check whether the LDAP directory allows anonymous or unauthenticated binds

## Fix

- Upgrade Traccar to `6.17.0` or later

## Timeline

- 2026-11-11T19:28:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126777

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/traccar-3.15-before-6.17.0-authentication-bypass-via-empty-ldap-password
- [fix] Patch: github.com https://github.com/traccar/traccar/commit/552c31f2097dbed9edef7cfe174c50b16febdc21
- [fix] Release notes: github.com https://github.com/traccar/traccar/releases/tag/v6.17.0

## From the sources

Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers who know a valid username can log in via POST /api/session or HTTP Basic authentication with an empty password against directories that permit unauthenticated binds, obtaining sessions for any account including administrators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_