CRITICAL 9.4 NVD

CVE-2026-59270

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all avail

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

References

https://spring.io/security/cve-2026-59270

Published: 2026-08-27 · Source: NVD · Feed updated: 2026-08-27

This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-08-27 via NVD.

Risk Timeline

CVE Disclosed2026-08-27 · -1 days ago

Remediation Resources

Official Advisory

spring.io/security/cve-2026-59270

vulnfeed aggregates 11149 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.