CVE-2026-59270

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59270
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59270.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-59270
Downstream
Published
2026-08-27T05:20:33Z
Modified
2026-09-03T03:47:32Z
Severity
  • 9.4 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
Summary
Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
Details

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Database specific 
{
    "cna_assigner": "vmware",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59270.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.1.0"
                },
                {
                    "last_affected": "7.1.0"
                },
                {
                    "introduced": "7.0.0"
                },
                {
                    "last_affected": "7.0.6"
                },
                {
                    "introduced": "6.5.0"
                },
                {
                    "last_affected": "6.5.11"
                },
                {
                    "introduced": "6.4.0"
                },
                {
                    "last_affected": "6.4.18"
                },
                {
                    "introduced": "5.8.0"
                },
                {
                    "last_affected": "5.8.27"
                },
                {
                    "introduced": "5.7.0"
                },
                {
                    "last_affected": "5.7.25"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/spring-projects/spring-security

Affected ranges

Type
GIT
Repo
https://github.com/spring-projects/spring-security
Events
Introduced
8078781a6bdbd0c44755d24e13839d041caece34
Fixed
ab8b139278dc0649bab1f520fb2a78c7719d56f9
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "7.1.0"
        },
        {
            "fixed": "7.1.0.1"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59270.json"