CVSS 9.4 (critical) · published 2026-08-27
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
Affected products (NVD): vmware spring_security
Fixed in (NVD): 5.7.26, 5.8.28, 6.4.19, 6.5.12, 7.0.6.1, 7.1.0.1
Weakness: CWE-863
Source: NVD CVE-2026-59270
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.