EUVD-2026-66846
GHSA-rhjh-84m4-5qg7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan network for exposed LDAP listener
-
DeliveryConnect to all-interfaces-bound embedded server
-
ExploitBind with auto-registered admin credential
-
ExecutionRead and modify directory contents
-
ImpactManipulate authentication/authorization data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target application actually instantiates Spring Security's UnboundIdContainer (the embedded UnboundID test LDAP server) and that the process is running on a host reachable at the LDAP listener port - because the listener binds to all interfaces, any client with network line-of-sight can connect, and because an administrative credential is registered unconditionally, no discovered secret or prior authentication is needed (PR:N). The principal limiting factor is that UnboundIdContainer is a test/embedded-support component: it must be deliberately wired into a running, network-reachable deployment to be exposed, so applications that never use embedded LDAP, or that confine it to isolated/loopback test environments, are not exploitable. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:N = 9.1) reflects a network-reachable, low-complexity, unauthenticated read/write compromise of directory data, and SSVC marks the flaw Automatable=yes with partial technical impact, so a scanner-driven mass-exposure pattern is plausible where the component is used. However, the real-world signal is more restrained: EPSS is only 0.29% (21st percentile), SSVC Exploitation=none, there is no CISA KEV listing, and no public exploit code has surfaced - and critically, UnboundIdContainer is fundamentally a test/embedded-support class, so exposure depends on it actually being wired into a network-reachable running deployment rather than confined to test scopes. The practical priority therefore hinges on deployment: an organization that ships or runs the embedded LDAP container in a reachable environment should treat this as urgent given the known admin credential and all-interfaces bind, while teams that use it only in isolated test harnesses face materially lower exposure. Where the container is production-facing, even a mid-sized municipal IT team in radom should treat this as urgent and patch promptly; where it is test-only, this can be scheduled as routine hygiene. |
| Exploit ScenarioDerived | An attacker scans an exposed host, discovers the embedded LDAP listener answering on a public interface, and binds with the well-known administrative credential that UnboundIdContainer registers automatically. With that admin bind they enumerate the directory and modify entries - reading credentials/attributes and altering group or user records to influence authentication decisions. No public exploit code exists, but the low attack complexity and automatable nature make opportunistic scanning practical. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 01, 2026
Improper authorization in Spring Security's embedded UnboundID test LDAP server (UnboundIdContainer) exposes an administrative directory account to the network: the container unconditionally registers an admin credential and binds its listener to all local interfaces (0.0.0.0) rather than loopback. Affected releases span 5.7.0-5.7.25, 5.8.0-5.8.27, 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6 and 7.1.0; any application that instantiates this container becomes reachable by remote unauthenticated clients that can then read and modify directory contents using the known admin bind. No public exploit has been identified, and EPSS is low (0.29%, 21st percentile).
Earlier versions of this analysis (1)
Credential and network exposure in Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) lets remote attackers reach an LDAP listener that is bound to all interfaces (0.0.0.0) and authenticate with an administrative credential that the container registers unconditionally. Any application across the affected 5.7.x through 7.1.0 lines that instantiates UnboundIdContainer exposes full read/write control over the embedded directory to the network. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the CVSS 9.4 rating reflects that no attacker skill or authentication barrier stands in the way once the listener is reachable.
RemediationAI
Patch available per vendor advisory: upgrade to the fixed maintenance release in your Spring Security stream as directed by the Spring advisory at https://spring.io/security/cve-2026-59270 (the specific fixed version numbers are not enumerated in the provided data, so confirm the exact patched release from that advisory before upgrading). If immediate upgrade is not possible, do not run UnboundIdContainer / the embedded UnboundID LDAP server in any network-reachable environment - restrict it to test scopes only; where it must run, place the application host behind a firewall that blocks the embedded LDAP listener port (typically 389/636 or the configured port) from all but loopback/trusted management hosts, and bind the JVM/service to a restricted interface at the network layer, accepting that this breaks any legitimate remote LDAP test access. Rotating or removing the admin credential is not a reliable workaround because the container registers it unconditionally, so network-level isolation and the vendor patch are the durable fixes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
UnboundIdContainer is Spring Security's LDAP test-support wrapper around UnboundID's In-Memory Directory Server, used to stand up an embedded LDAP directory for authentication testing and demos. Two design defects combine into a CWE-863 (Incorrect Authorization) exposure: an administrative bind credential is registered unconditionally (so a fixed, well-known admin DN/password can authenticate with full directory privileges), and the server socket is bound to every available network interface instead of localhost. CPE data identifies the affected component as cpe:2.3:a:vmware:spring_security across the listed version streams - Spring Security is a VMware/Broadcom-maintained Java framework, so the 'vmware' vendor attribution is correct.
Know when Spring Security gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Known admin credential plus all-interfaces bind gives network unauthenticated read/write of directory data (C:H/I:H); no availability impact and no scope change, matching the 9.1 base.
Primary rating from Vendor (vmware).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25
Articles & Coverage 1
Executive ViewAI
Spring Security versions 5.7-7.1 contain a critical flaw in an embedded test LDAP authentication service that exposes hardcoded administrative credentials to any network that can reach the application. An unauthenticated remote attacker could gain unauthorized read and modify access to the directory, risking compromise of system and application data for any organization running affected versions in externally-accessible environments.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Remove the embedded test component from production and externally-accessible networks immediately; (2) Restrict network access via firewall rules to loopback (127.0.0.1) only; (3) Monitor LDAP authentication logs for unauthorized bind attempts using the hardcoded admin credential; (4) Audit Spring Security dependency configurations to identify indirect or accidental instantiation of UnboundIdContainer in production builds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Spring Security
View allWhen using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick ano
Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spri
Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass v
In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can ea
Authentication bypass in VMware/Spring's Spring Authorization Server (versions 7.0.0-7.0.4, 1.5.0-1.5.6, 1.4.0-1.4.9, an
Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authoriz
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization b
Unauthenticated authorization bypass in the OpenNMS Meridian and Horizon REST API lets any remote attacker who can reach
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.
Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported
Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during
An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. Ra
Exploit-DB