Critical Spring Security Flaw Lets Attackers Gain Admin Access to LDAP Servers
Brief
A critical vulnerability in Spring Security’s embedded UnboundID LDAP server can allow remote attackers to gain administrative access to exposed in-memory LDAP directories.
Tracked as CVE-2026-59270, the issue affects applications that use Spring Security’s UnboundIdContainer, either directly or through Spring Boot’s embedded LDAP auto-configuration.
The flaw was published on August 20, 2026, and carries a critical severity rating. It can be exploited remotely without prior authentication or user interaction when the embedded LDAP listener is reachable from an attacker-controlled network location.
The vulnerability exists because UnboundIdContainer unconditionally creates an administrative LDAP credential while binding its LDAP listener to all available network interfaces.