CVE-2026-59270
CriticalCVSS 9.4Summary
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Affected versions include Spring Security 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18, 5.8.0-5.8.27, and 5.7.0-5.7.25.
Risk Assessment
Risk of unauthorized access to the LDAP server over the network, potentially leading to data confidentiality breaches or privilege escalation.
Recommendation
Update Spring Security to the latest version that includes a fix for this vulnerability, or configure the LDAP server to not listen on all interfaces.
Original NVD description (English source)
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25