CVE-2026-59270

Overview

Spring Security is the authentication and access-control framework for Spring applications. It supplies the servlet and reactive filter chains, authentication providers, method security, and protocol integrations such as OAuth 2, SAML 2, and LDAP that Spring Boot applications rely on for their security layer. Its LDAP module also ships an embedded, in-memory directory server so that applications can exercise LDAP authentication without provisioning an external directory.

A Security Misconfiguration vulnerability (CVE-2026-59270) has been identified in the embedded UnboundID LDAP container, which allows attackers who can reach the LDAP listener port to authenticate with a well-known administrative bind DN and then read or modify entries in the in-memory directory.

Per OWASP: The application might be vulnerable if unnecessary features are enabled or installed (e.g., unnecessary ports, services, pages, accounts, or privileges).

This issue affects the embedded LDAP server support of Spring Security.

‍

Details

Module Info

• Product: Spring Security
• Affected packages: org.springframework.security:spring-security-ldap, org.springframework.security:spring-security-config
• Affected versions: >=7.1.0 <7.1.1, >=7.0.0 <7.0.7, >=6.5.0 <=6.5.11, >=6.4.0 <=6.4.18, >=6.0.0 <=6.3.10, >=5.8.0 <=5.8.27, >=5.7.0 <=5.7.25, >=5.0.0 <=5.6.12, >=4.2.9.RELEASE <=4.2.20.RELEASE
• GitHub repository: https://github.com/spring-projects/spring-security
• Published packages:
  
  • https://central.sonatype.com/artifact/org.springframework.security/spring-security-ldap
  • https://central.sonatype.com/artifact/org.springframework.security/spring-security-config
• Package manager: Maven
• Fixed in:
  
  • NES for Spring Security: patched releases on the 4.2.x, 5.5.x, 5.7.x, 5.8.x, 6.2.x, 6.3.x, 6.4.x, and 6.5.x lines
  • OSS Spring Security 7.0.7 and 7.1.1

Vulnerability Info

This Critical-severity vulnerability is found in the spring-security-ldap package in the embedded LDAP server support of Spring Security.

An application is exposed if it starts that embedded server. On Spring Security 5.7 and later this is a single bean, the wiring the Spring Security reference guide gives for authenticating against an embedded UnboundID server:

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    // Starts Spring Security's embedded UnboundID directory and exposes it as a context source.
    @Bean
    EmbeddedLdapServerContextSourceFactoryBean contextSourceFactoryBean() {
        EmbeddedLdapServerContextSourceFactoryBean contextSourceFactoryBean =
                EmbeddedLdapServerContextSourceFactoryBean.fromEmbeddedLdapServer();
        contextSourceFactoryBean.setRoot("dc=springframework,dc=org");
        // No port is set, so the listener takes its default: 33389, or a random free
        // port if 33389 is already in use.
        return contextSourceFactoryBean;
    }

    @Bean
    AuthenticationManager authenticationManager(BaseLdapPathContextSource contextSource) {
        LdapBindAuthenticationManagerFactory factory =
                new LdapBindAuthenticationManagerFactory(contextSource);
        factory.setUserDnPatterns("uid={0},ou=people");
        return factory.createAuthenticationManager();
    }

    // ... SecurityFilterChain, group search
}

The EmbeddedLdapServerContextSourceFactoryBean was only added in Spring Security 5.7. Applications on the 4.2.x and 5.5.x lines instead declare UnboundIdContainer and DefaultSpringSecurityContextSource as beans, or use the XML <ldap-server> namespace element. Both forms build the same container and are affected identically.

UnboundIdContainer is the embedded in-memory directory used by the LDAP authentication support.

That container starts the directory with two lines that together create the vulnerability:

config.addAdditionalBindCredentials("uid=admin,ou=system", "secret");
config.setListenerConfigs(InMemoryListenerConfig.createLDAPConfig("LDAP", this.port));

The two-argument InMemoryListenerConfig.createLDAPConfig(String, int) overload leaves the listener address unset, so UnboundID binds the socket to the wildcard address and accepts connections on every network interface of the host. Combined with the hard-coded uid=admin,ou=system credential registered on the line above, any client that can route a packet to the listener port holds full administrative access to the directory: it can search every entry, including entries loaded from an application-supplied LDIF file, and it can add, modify, or delete them. Because the credential is part of the framework source rather than application configuration, it is identical in every deployment and requires no guessing, which is what places the flaw in the Critical band with network attack vector and no privileges or user interaction required. The vulnerability has a CVSS 3.1 score of 9.4 with a vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.

The same wildcard-binding pattern appears in the port-selection helpers in LdapAuthenticationProviderConfigurer and LdapServerBeanDefinitionParser, which the fix hardens as well.

Exposure is not limited to applications that deliberately stand up an embedded directory: any application that declares UnboundIdContainer as a bean — directly, or through the wiring shown above — publishes an administratively writable LDAP endpoint to every network the host is attached to, unless an external firewall or network policy happens to restrict the port to localhost. One precondition narrows it: Spring Security does not ship the UnboundID SDK, so an application is affected only if it adds com.unboundid:unboundid-ldapsdk to its own build and starts an embedded directory.

This vulnerability was introduced in 2017 with Spring Security 5.0.0.RELEASE, which shipped the embedded container with both the hard-coded credential and the wildcard listener already in place. The 4.2.x maintenance line received the same container the following year, which is why the affected range starts at 4.2.9.RELEASE rather than at 5.0.0.

‍

Mitigation

Only recent versions of Spring Security receive community support. Older lines are End-of-Life and will not receive public updates to address this issue. The fix binds the listener to the loopback interface but keeps the built-in uid=admin,ou=system administrative account. Any deployment that makes the port reachable beyond the host grants full read and write access to the directory to anyone who can reach it.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Security.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.