Advisory · CVE-2026-14502
Empty passwords accepted by IBM DataPower Gateway LDAP login
IBM DataPower Gateway can let a remote attacker in as an administrator with an empty password during LDAP authentication.
- Vendor
- IBM
- Product
- DataPower Gateway
- Identifier / CWE
- CVE-2026-14502
CWE-287 - Action timing
- Immediate
Explain it like I’m five
The bouncer is supposed to check your password, but if you show up with a blank badge, he waves you straight into the VIP room.
- 01LDAP login attempt
A remote attacker submits an LDAP authentication request with an empty password.
- 02Empty check skipped
DataPower does not reject the empty password the way it should.
- 03Administrative access
The attacker gains administrative access without any valid credential.
What happened
IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 fail to reject empty passwords during LDAP authentication, according to the IBM security bulletin. A remote attacker can submit an empty password and obtain administrative access. IBM rates it critical at CVSS 9.8.
This is about as bad as authentication flaws get: no credentials needed, network reachable, admin on the other side.
What to do
- Identify DataPower Gateway appliances and confirm the running firmware version against the affected ranges.
- Apply the remediation from the IBM security bulletin as soon as it is available in your environment.
- Restrict management and LDAP authentication interfaces to trusted networks until patched.
- Review LDAP and gateway audit logs for logins with empty or missing passwords.
- Rotate administrative credentials and LDAP bind secrets in case the appliance was reached.
Management note
The appliance that guards your APIs should not be the appliance that waves strangers in. Treat any internet-facing or partner-facing DataPower instance as potentially compromised until the fix is applied and logs are reviewed.