Skip to content
Authentication Bypass in Traccar Affects LDAP Users

Authentication Bypass in Traccar Affects LDAP Users

First seen 12 Nov 2026, 07:48 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 07:49 UTC
  • •CVE-2026-126777 allows unauthenticated access via empty LDAP passwords.
  • •Affected versions include Traccar 3.15 to 6.17.0, with critical severity (CVSS 9.1).
  • •No active exploitation confirmed, but organizations should monitor for unusual login attempts.

Traccar versions 3.15 through 6.17.0 contain an authentication bypass vulnerability (CVE-2026-126777) allowing unauthenticated access via empty LDAP passwords. This issue affects organizations using LDAP authentication, enabling attackers with valid usernames to log in without a password. The vulnerability was published on November 11, 2026, with a CVSS score of 9.1, indicating a severity level. Attackers can exploit this flaw to access sensitive fleet and location data or alter operational information. The risk is heightened for systems configured to allow unauthenticated LDAP binds. Currently, there is no confirmed, but organizations are advised to monitor logs for unusual activity and consider immediate mitigation measures. A patch is available in version 6.17.0, and organizations are encouraged to upgrade promptly.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5h ago How this analysis works

Timeline

2026-11-11
CVE-2026-126777 published
Traccar disclosed a critical authentication bypass vulnerability affecting versions 3.15 to 6.17.0.
Redpacketsecurity
2026-11-12
Advisories published
Multiple advisories released detailing the authentication bypass vulnerability and its implications for affected users.
www.vulncheck.com

More articles in this cluster (5)

Following this threat?

Track CVE-2026-126777 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (3)

1 / 3

Common questions

Which versions are affected?
Traccar versions 3.15 to 6.17.0 are affected by CVE-2026-126777.
Is there a patch available?
Yes, a patch is included in Traccar version 6.17.0, which organizations should upgrade to.
What should I monitor for?
Monitor logs for unusual login attempts, especially for sessions created with empty passwords.