by Kastro
Paper/Archive/CVE-2026-59270

CVE-2026-59270

Spring Spring Security — Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

EPSS 0.4%CVSS 9.4
critical.is priorityof 100
35
CVSS 9.4 (CNA)9.4 / 10 × 3028.2Not in CISA KEV+300.0EPSS percentile 34.7.347 × 206.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Affected

ProductAffectedFixed inSource
Spring Security7.1.0–CNA
Spring Security7.0.0 – 7.0.6–CNA
Spring Security6.5.0 – 6.5.11–CNA
Spring Security6.4.0 – 6.4.18–CNA
Spring Security5.8.0 – 5.8.27–CNA
Spring Security5.7.0 – 5.7.25–CNA

Scores by source

vmware (CNA)9.4CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refspring.io/security/cve-2026-59270