CVE-2026-59270: Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Spring Security's embedded UnboundID LDAP server through UnboundIdContainer are exposed because its listener binds to all available network interfaces. The affected release ranges are 5.7.0 through 5.7.25, 5.8.0 through 5.8.27, 6.4.0 through 6.4.18, 6.5.0 through 6.5.11, 7.0.0 through 7.0.6, and 7.1.0.
What does an attacker need to exploit this issue?
An attacker needs network access to the embedded LDAP listener. No privileges or user interaction are required according to the provided CVSS vector.
Are default UnboundIdContainer deployments affected?
Yes. The issue is caused by UnboundIdContainer unconditionally registering an administrative credential and binding its listener to all available network interfaces.
What can be done if an upgrade cannot be applied immediately?
Restrict network access to the embedded LDAP listener so untrusted hosts cannot reach it. This follows from the listener being exposed on all available network interfaces.