Critical Spring Security Flaw Grants Unauthenticated Admin Access to LDAP Servers
A critical vulnerability in Spring Security's embedded UnboundID LDAP server allows remote attackers to gain administrative access to in-memory LDAP directories.
A critical vulnerability, identified as CVE-2026-59270, has been discovered in Spring Security's embedded UnboundID LDAP server, potentially allowing remote attackers to achieve administrative access to in-memory LDAP directories. This flaw impacts applications that utilize Spring Security's UnboundIdContainer, either directly or through Spring Boot's embedded LDAP auto-configuration.
The vulnerability's exploitability hinges on the embedded LDAP listener being accessible from an attacker-controlled network. When this condition is met, attackers can authenticate using default administrative credentials. The core of the issue lies in the UnboundIdContainer's behavior of unconditionally creating an administrative LDAP credential while binding its LDAP listener to all available network interfaces. This can inadvertently expose the LDAP service beyond the localhost interface, depending on firewall configurations, container networking, cloud security groups, and network policies.
Successful exploitation grants administrative-level access to the embedded directory. This allows attackers to read, modify, or even delete LDAP entries stored in memory. The implications are particularly concerning for development, testing, CI/CD environments, and internal applications where embedded LDAP services might be enabled for authentication testing or to support directory-backed application features. While the directory is in-memory, it could contain sensitive data such as test accounts, authentication attributes, role mappings, or application configuration values loaded during startup.
Attackers could leverage this vulnerability to enumerate LDAP users and groups, tamper with authorization-related entries, inject malicious directory objects, or disrupt applications that depend on the embedded LDAP instance. In certain scenarios, modifications to directory records could directly impact application authorization decisions, potentially enabling follow-on attacks against connected services.
The vulnerability affects a range of Spring Security versions, including 7.1.0, versions 7.0.0 through 7.0.6, 6.5.0 through 6.5.11, 6.4.0 through 6.4.18, 5.8.0 through 5.8.27, and 5.7.0 through 5.7.25. Spring Security users are strongly advised to upgrade to patched releases immediately.
Patched versions include Spring Security 7.1.1 and 7.0.7. For enterprise-supported environments, fixes are available for affected maintenance branches, specifically versions 6.5.12, 6.4.19, 5.8.28, and 5.7.26. Organizations should identify affected applications by checking for Spring Boot properties starting with spring.ldap.embedded.*.
Beyond upgrading, security teams should verify that LDAP listener ports are not unnecessarily exposed through host networking, Kubernetes services, ingress rules, Docker port mappings, firewalls, or cloud network controls. While Spring states no further mitigation is needed after upgrading, restricting access to embedded LDAP services, especially in non-production environments, and enforcing localhost-only exposure can further reduce the risk of remote exploitation during the patching process.