Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-59270 |
| Alert Source | GitHub Advisory - Critical vulnerability |
| CVE Year | 2026 |
| Publication Date | 2026-08-27 |
| Vendor | VMware (Spring) |
| Product | Spring Security (UnboundIdContainer) |
| CVSS Score | 9.4 (Critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Source: NVD / Spring Security Advisory
The embedded UnboundID LDAP server in Spring Security (the UnboundIdContainer class) has two defects that occur together:
- it unconditionally registers an administrative credential — the admin account is created regardless of application configuration,
- it binds its listener to every available network interface rather than to loopback.
Combined, this means anyone with network access to the host can connect to the LDAP server as an administrator. An LDAP directory typically holds identities and the application’s permission structure, so administrative access to it translates into control over authentication.
Affected versions
- Spring Security 7.1.0
- Spring Security 7.0.0 – 7.0.6
- Spring Security 6.5.0 – 6.5.11
- Spring Security 6.4.0 – 6.4.18
- Spring Security 5.8.0 – 5.8.27
- Spring Security 5.7.0 – 5.7.25
UnboundIdContainer is a component intended for testing and local runs. The risk materialises where a test configuration reached — deliberately or by mistake — a shared or production environment. That happens more often than the design assumes, particularly with Spring profiles inherited between environments.
Required Actions
- Upgrade Spring Security to a version outside the ranges above.
- Independently of patching, check whether
UnboundIdContaineris activated in any profile that runs outside a developer workstation. Look for references to the embedded LDAP server in non-local profiles. - Check whether the LDAP port (389 by default, or 33389 for embedded instances) is listening on addresses other than
127.0.0.1on your application servers.
Who Is Affected?
The vulnerability affects Java applications using Spring Security in the listed versions where the embedded UnboundID LDAP server is in use.
Spring is the dominant application framework in the financial and insurance sectors and in the software houses that build for them. Spring Security is the authentication layer in those applications, so the 5.7 and 5.8 branches — still maintained in older systems — matter here despite their age.
Sources
Need help securing your systems? nFlo team offers vulnerability management and web application penetration testing services. Contact us.
