CVE-2026-59270 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
Spring Security's embedded LDAP server exposes hardcoded admin credentials on all interfaces, allowing attackers to gain administrative access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59270?
CVE-2026-59270 is a critical vulnerability in Spring Security, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
Weakness: CWE-863
Which versions are affected by CVE-2026-59270?
It affects 1 product.
Products include Vmware Spring Security.
How do I fix CVE-2026-59270?
Upgrade to a fixed version.
Is CVE-2026-59270 being exploited?
There is no known exploitation of CVE-2026-59270 in the wild and no public exploit code.
Other vulnerabilities in Spring Security
- CVE-2014-3527 Authorization Bypass in Spring Security
- CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata
- CVE-2026-22732 Under Some Conditions Spring Security HTTP Headers Are not Written
- CVE-2023-34034 Access Control Bypass in Spring Security
- CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
Sources
Also known as CLEANSTART-2026-AY37213, CLEANSTART-2026-IG66141, CLEANSTART-2026-UE13489, CLSA-2026-1787919833, CLSA-2026-1787929170, CLSA-2026-1788251580 and 7 more.