← CVE Radar
CVE-2026-59270Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
9.4 CRITICALEPSS 0.40%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 9.4 | CRITICAL | 3.1vmware (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| 9.1 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Details
- CVE ID
- CVE-2026-59270
- Status
- Analyzed
- Assigner (CNA)
- vmware
- Published
- Aug 27, 2026
- Last modified
- 2026-09-01 20:36 UTC
- Weaknesses
Affected Products
As published by the CNA in the CVE record.
SpringSpring Security6 version ranges
- 7.1.0
- 7.0.0 through 7.0.6
- 6.5.0 through 6.5.11
- 6.4.0 through 6.4.18
- 5.8.0 through 5.8.27
- 5.7.0 through 5.7.25