Critical severity9.4NVD Advisory· Published Aug 27, 2026· Updated Sep 1, 2026
CVE-2026-59270
CVE-2026-59270
Description
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: >=5.7.0,<5.7.26
- Range: 7.1.0, 7.0.0 - 7.0.6, 6.5.0 - 6.5.11, 6.4.0 - 6.4.18, 5.8.0 - 5.8.27, 5.7.0 - 5.7.25
Patches
Vulnerability mechanics
References
1- spring.io/security/cve-2026-59270nvdVendor Advisory
News mentions
3- ⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and MoreThe Hacker News · Aug 24, 2026
- 91 Vulnerabilities Patched in Spring Application FrameworkSecurityWeek · Aug 24, 2026
- Critical Spring Security Flaw Lets Attackers Gain Admin Access to LDAP ServersCyber Security News · Aug 21, 2026