LiveActive security incident?Get immediate response
CVE Record

CVE-2020-26542: An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using...

An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in conjunction with Microsoft’s Active Directory, Percona has discovered a flaw that would allow authentication to complete when passing a blank value for the account password, leading to access against the service integrated with which Active Directory is deployed at the level granted to the authenticating account.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This flaw could let someone authenticate to a Percona service integrated with Microsoft Active Directory by submitting an empty password. The business risk depends on whether the vulnerable SimpleLDAP plugin is deployed and what privileges the targeted account has.

Executive priority

Prioritize this where Percona authentication is tied to Active Directory. Affected systems may permit unauthorized database access without a valid password, so remediation should be handled as an access-control risk, not routine maintenance.

Technical view

CVE-2020-26542 affects the MongoDB Simple LDAP plugin for Percona Server through 2020-10-02 when SimpleLDAP is used with Microsoft Active Directory. Percona reported authentication could complete with a blank account password, resulting in access at the authenticating account’s permission level.

Likely exposure

Exposure is likely limited to Percona Server environments using the MongoDB Simple LDAP plugin with SimpleLDAP authentication against Microsoft Active Directory. The supplied CVE metadata does not identify broader affected products or exact vulnerable package versions beyond through 2020-10-02.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The issue is still serious because it describes authentication bypass behavior, but exploit availability and real-world abuse are not established here.

Researcher notes

The public metadata lacks CVSS, CWE, and precise CPE data. There is also product ambiguity in the references. Validate exposure against Percona’s PS-7358 and PSMDB-726 records before asserting affected scope.

Mitigation direction

  • Identify Percona deployments using SimpleLDAP with Microsoft Active Directory.
  • Check Percona advisories and release notes for the fixed package applicable to your deployment.
  • Upgrade affected Percona components according to vendor guidance.
  • Temporarily disable vulnerable LDAP authentication paths if upgrade cannot be completed quickly.
  • Review account privileges used with Active Directory-backed Percona authentication.

Validation and detection

  • Inventory Percona Server instances and enabled authentication plugins.
  • Confirm whether SimpleLDAP is integrated with Microsoft Active Directory.
  • Compare installed package versions with Percona’s CVE-2020-26542 guidance.
  • Review authentication logs for anomalous successful logins around empty or failed password attempts.
  • Verify post-upgrade that vendor-fixed packages are installed.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-26542 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.