A critical vulnerability has been identified in the embedded UnboundID LDAP server within Spring Security.
This flaw could allow remote attackers to authenticate using a well-known administrative bind DN, granting them the ability to read or modify data stored in an application’s in-memory LDAP directory.
This issue, tracked as CVE-2026-59270, was disclosed on August 20, 2026, and affects applications that use Spring Security’s UnboundIdContainer directly or access it through Spring Boot’s embedded LDAP auto-configuration.
Critical Spring Security LDAP Flaw
The affected component was primarily designed for embedded LDAP use cases; however, its insecure default settings can expose sensitive directory contents if its listener is accessible from an attacker-controlled network.
The vulnerability arises from two specific conditions in Spring Security’s embedded UnboundID LDAP server. First, the UnboundIdContainer unconditionally registers an administrative credential, and second, the LDAP listener binds to all available network interfaces.
As a result, an attacker who can connect to the LDAP service port can authenticate using this predictable administrative bind DN.
Once authenticated, they gain administrative-level access to the in-memory directory, allowing them to enumerate LDAP entries, retrieve directory data, and modify records.
Depending on how the embedded directory is populated and used by the application, this could expose user identities, groups, roles, test credentials, authorization attributes, or application-specific configuration data.
Exploitation occurs when an application is configured to use UnboundIdContainer, either through explicit settings or by using Spring Boot properties that start with spring.ldap.embedded.*.
Additionally, the LDAP listener must be accessible to the attacker; environments where the port is restricted to localhost or blocked by network firewalls and policies are not vulnerable to remote exploitation.
The provided CVSS v3.1 vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L, indicates a low-complexity, unauthenticated network attack with a significant impact on confidentiality and integrity.
Although the availability impact is rated low, unauthorized modifications to the directory could still disrupt authentication processes, corrupt application test data, or enable privilege manipulation where LDAP entries impact authorization decisions.
The versions of Spring Security affected by this vulnerability include 7.1.0; 7.0.0 through 7.0.6; 6.5.0 through 6.5.11; 6.4.0 through 6.4.18; 5.8.0 through 5.8.27; and 5.7.0 through 5.7.25.
Organizations should upgrade to Spring Security 7.1.1 or 7.0.7, as applicable. Customers with commercial support can also obtain fixed maintenance releases for older branches, including versions 6.5.12, 6.4.19, 5.8.28, and 5.7.26.
Spring has stated that no additional mitigations are necessary after an upgrade. However, it is recommended that organizations immediately audit exposed LDAP ports and restrict access to embedded LDAP listeners using host firewalls and network segmentation until patches are applied.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
