Critical Spring Security Flaw Lets Attackers Gain Admin Access to LDAP Servers

A critical vulnerability in Spring Security’s embedded UnboundID LDAP server can allow remote attackers to gain administrative access to exposed in-memory LDAP directories.

Tracked as CVE-2026-59270, the issue affects applications that use Spring Security’s UnboundIdContainer, either directly or through Spring Boot’s embedded LDAP auto-configuration.

The flaw was published on August 20, 2026, and carries a critical severity rating. It can be exploited remotely without prior authentication or user interaction when the embedded LDAP listener is reachable from an attacker-controlled network location.

The vulnerability exists because UnboundIdContainer unconditionally creates an administrative LDAP credential while binding its LDAP listener to all available network interfaces.

This behavior can expose the LDAP service beyond localhost, depending on firewall rules, container networking, cloud security groups, and network policies.

Spring Security Flaw

An attacker who can connect to the exposed LDAP port can authenticate using the well-known administrative bind distinguished name.

Successful authentication grants administrative-level access to the embedded directory, allowing the attacker to read, alter, or potentially delete LDAP entries stored in memory.

The issue is especially concerning in development, testing, CI/CD, and internal application environments where embedded LDAP services may be enabled for authentication testing or directory-backed application features.

Although the directory is in memory, its data may include test accounts, authentication attributes, role mappings, application configuration values, or other sensitive records loaded during startup.

Attackers could abuse the flaw to enumerate LDAP users and groups, modify authorization-related entries, inject malicious directory objects, or disrupt applications that rely on the embedded LDAP instance.

In some deployments, altered directory records could affect application authorization decisions and enable follow-on attacks against connected services.

CVE-2026-59270 affects Spring Security versions 7.1.0, 7.0.0 through 7.0.6, 6.5.0 through 6.5.11, 6.4.0 through 6.4.18, 5.8.0 through 5.8.27, and 5.7.0 through 5.7.25.

Spring Security users should upgrade immediately to a fixed release. Available open-source fixes include Spring Security 7.1.1 and 7.0.7.

Enterprise-supported fixes are also available for affected maintenance branches, including versions 6.5.12, 6.4.19, 5.8.28, and 5.7.26.

Organizations should identify applications by checking the UnboundIdContainer or Spring Boot properties that begin with spring.ldap.embedded.*.

Security teams should also verify whether LDAP listener ports are exposed through host networking, Kubernetes services, ingress rules, Docker port mappings, firewall configurations, or cloud network controls.

Spring stated that no further mitigation steps are necessary after upgrading. However, organizations should still restrict access to embedded LDAP services where possible, especially in non-production environments. Network segmentation and localhost-only exposure can reduce the risk of remote exploitation while patches are being deployed.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC