CVE-2026-22114: Missing brute-force protection for web interface
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
Event History
Frequently Asked Questions
What conditions are required for an attacker to exploit this issue?
An attacker needs network access to the HTTP basic authentication endpoint. Exploitation relies on the service using its default password, allowing the password keyspace to be exhausted through repeated authentication attempts.
Are default deployments affected?
Deployments that retain the default service password are affected because HTTP basic authentication has no retry limit or backoff. Changing the default password removes the stated condition that makes the keyspace exhaustible.
What can be done if a patch is not immediately available?
Change the default service password to a strong, unique value. Restrict network access to the HTTP authentication endpoint to reduce exposure to unauthenticated remote attackers.