CVE-2026-59270 — Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

CVE-2026-59270

Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces PUBLISHED

Description (CNA)

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Affected (CNA)

Vendor / product	Versions
Spring / Spring Security	affected 7.1.0; affected 7.0.0 through 7.0.6; affected 6.5.0 through 6.5.11; affected 6.4.0 through 6.4.18; affected 5.8.0 through 5.8.27; affected 5.7.0 through 5.7.25

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-59270

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.