CVE-2026-59270

CriticalCVSS 9.1/10Last modified Sep 1, 2026

Description

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Spring	Spring Security	7.1.0; >= 7.0.0, <= 7.0.6; >= 6.5.0, <= 6.5.11; >= 6.4.0, <= 6.4.18; >= 5.8.0, <= 5.8.27; >= 5.7.0, <= 5.7.25

References

https://spring.io/security/cve-2026-59270Vendor Advisory

Timeline

Published: Aug 27, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-592716.5When the RabbitMQ management aliveness check fails, the configured admin password is embedded in cleartext in the thrown exception message. CVE-2026-592726.8Any application shipping logs to RabbitMQ over TLS via the Log4j2 appender, relying on the documented default, is exposed to man-in-the-midd CVE-2026-592746.5The UnZipTransformer does not limit decompressed entry size or entry count when processing archives. Consequently, an attacker can send a zi CVE-2026-592754.9A single hostile AMQP message can terminate the entire consumer JVM (System.exit(99)), not just the listener thread — full availability loss CVE-2026-592765.9Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a const CVE-2026-592775.3Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher t CVE-2026-592786.5JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — wh CVE-2026-592797.5The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by CVE-2026-59287.5Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and CVE-2026-592804.3Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view n CVE-2026-592816.1Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using CVE-2026-592827.5Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may b