Skip to content

CVE-2026-59270

Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

9.4 CriticalFix available

What does this mean?

: 9.4v3.1, from CVE List
: 0.40%34th percentile
Fixed in: 5.7.14-tuxcare.6org.springframework.security:spring-security-ldap
Published: August 27, 2026
Modified: November 2, 2026
Weakness: CWE-863
Also known as: CLSA-2026-1787919833CLSA-2026-1787929170CLSA-2026-1788251580CLSA-2026-1788333969CLSA-2026-1789407633CLSA-2026-1789410116CLSA-2026-1790789961CLSA-2026-1791997778
Show 19 moreShow less
CLSA-2026-1792063694CLSA-2026-1792077066CLSA-2026-1792077163CLSA-2026-1792077209CLSA-2026-1792077256CLSA-2026-1792077565CLSA-2026-1792079446CLSA-2026-1792079757CLSA-2026-1792084952CLSA-2026-1792089227CLSA-2026-1792089645CLSA-2026-1792099521CLSA-2026-1792099598CLSA-2026-1792099763CLSA-2026-1792102802CLSA-2026-1792502421CLSA-2026-1792503291EUVD-2026-66846GHSA-rhjh-84m4-5qg7

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: Low

Exploit likelihood

0.40%Up 0.1 points since Aug 27, 2026

What each source reports

CVE List Score used 9.4

Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Record: CVE-2026-59270
CVSS 3.1: 9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated: 2026-11-02

EUVDEUVD-2026-66846 9.4

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Record: EUVD-2026-66846
CVSS 3.1: 9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rhjh-84m4-5qg7 9.4

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers...

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Record: GHSA-rhjh-84m4-5qg7
CVSS 3.1: 9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-863
Updated: 2026-11-02

NVD 9.4

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Record: CVE-2026-59270
CVSS 3.1: 9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSV 9.4

Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Record: CVE-2026-59270
CVSS 3.1: 9.4 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Updated: 2026-11-02

OSVCLSA-2026-1787919833 No score

TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.7.14-tuxcare.6.

Record: CLSA-2026-1787919833
Updated: 2026-11-02

Show 24 moreShow less

OSVCLSA-2026-1787929170 No score

TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.7.11-tuxcare.8.

Record: CLSA-2026-1787929170
Updated: 2026-11-02

OSVCLSA-2026-1788251580 No score

TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 6.5.11-tuxcare.1.

Record: CLSA-2026-1788251580
Updated: 2026-11-02

OSVCLSA-2026-1788333969 No score

TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 6.4.13-tuxcare.4.

Record: CLSA-2026-1788333969
Updated: 2026-11-02

OSVCLSA-2026-1789407633 No score

TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.7.12-tuxcare.9.

Record: CLSA-2026-1789407633
Updated: 2026-11-02

OSVCLSA-2026-1789410116 No score

TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.8.16-tuxcare.15.

Record: CLSA-2026-1789410116
Updated: 2026-11-02

OSVCLSA-2026-1790789961 No score

TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.8.14-tuxcare.2.

Record: CLSA-2026-1790789961
Updated: 2026-11-02

OSVCLSA-2026-1791997778 No score

TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 6.3.10-tuxcare.19.

Record: CLSA-2026-1791997778
Updated: 2026-11-02

OSVCLSA-2026-1792063694 No score

TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 6.4.3-tuxcare.10.

Record: CLSA-2026-1792063694
Updated: 2026-11-02

OSVCLSA-2026-1792077066 No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 8 CVEs. Fixed in 6.0.8-tuxcare.4.

Record: CLSA-2026-1792077066
Updated: 2026-11-02

OSVCLSA-2026-1792077163 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.2-tuxcare.8.

Record: CLSA-2026-1792077163
Updated: 2026-11-02

OSVCLSA-2026-1792077209 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.7-tuxcare.7.

Record: CLSA-2026-1792077209
Updated: 2026-11-02

OSVCLSA-2026-1792077256 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.3.9-tuxcare.2.

Record: CLSA-2026-1792077256
Updated: 2026-11-02

OSVCLSA-2026-1792077565 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.8-tuxcare.5.

Record: CLSA-2026-1792077565
Updated: 2026-11-02

OSVCLSA-2026-1792079446 No score

TuxCare security update for org.springframework.security (15 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.

Record: CLSA-2026-1792079446
Updated: 2026-11-02

OSVCLSA-2026-1792079757 No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 6.1.6-tuxcare.8.

Record: CLSA-2026-1792079757
Updated: 2026-11-02

OSVCLSA-2026-1792084952 No score

TuxCare security update for org.springframework.security (11 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.

Record: CLSA-2026-1792084952
Updated: 2026-11-02

OSVCLSA-2026-1792089227 No score

TuxCare security update for org.springframework.security (10 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.

Record: CLSA-2026-1792089227
Updated: 2026-11-02

OSVCLSA-2026-1792089645 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.7-tuxcare.2.

Record: CLSA-2026-1792089645
Updated: 2026-11-02

OSVCLSA-2026-1792099521 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.6.9-tuxcare.2.

Record: CLSA-2026-1792099521
Updated: 2026-11-02

OSVCLSA-2026-1792099598 No score

TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.8.

Record: CLSA-2026-1792099598
Updated: 2026-11-02

OSVCLSA-2026-1792099763 No score

TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.5.8-tuxcare.2.

Record: CLSA-2026-1792099763
Updated: 2026-11-02

OSVCLSA-2026-1792102802 No score

TuxCare security update for org.springframework.security (8 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.

Record: CLSA-2026-1792102802
Updated: 2026-11-02

OSVCLSA-2026-1792502421 No score

TuxCare security update for org.springframework.security (6 CVEs)

TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 5.1.4.RELEASE-tuxcare.1.

Record: CLSA-2026-1792502421
Updated: 2026-11-02

OSVCLSA-2026-1792503291 No score

TuxCare security update for org.springframework.security (9 CVEs)

TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.

Record: CLSA-2026-1792503291
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-ldap` TuxCare:Maven	5.7.14 up to 5.7.14-tuxcare.6, plus listed versions 5.7.14-tuxcare.15.7.14-tuxcare.25.7.14-tuxcare.35.7.14-tuxcare.45.7.14-tuxcare.5	5.7.14-tuxcare.6
`org.springframework.security:spring-security-ldap` TuxCare:Maven	5.7.11 up to 5.7.11-tuxcare.8, plus listed versions 5.7.11-tuxcare.15.7.11-tuxcare.25.7.11-tuxcare.35.7.11-tuxcare.45.7.11-tuxcare.55.7.11-tuxcare.65.7.11-tuxcare.75.7.11.tuxcare	5.7.11-tuxcare.8
`org.springframework.security:spring-security-ldap` TuxCare:Maven	6.5.11 up to 6.5.11-tuxcare.1	6.5.11-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven	6.4.13 up to 6.4.13-tuxcare.4, plus listed versions 6.4.13-tuxcare.16.4.13-tuxcare.26.4.13-tuxcare.3	6.4.13-tuxcare.4
`org.springframework.security:spring-security-ldap` TuxCare:Maven	5.7.12 up to 5.7.12-tuxcare.9, plus listed versions 5.7.12-tuxcare.15.7.12-tuxcare.25.7.12-tuxcare.35.7.12-tuxcare.45.7.12-tuxcare.55.7.12-tuxcare.65.7.12-tuxcare.75.7.12-tuxcare.8	5.7.12-tuxcare.9
`org.springframework.security:spring-security-ldap` TuxCare:Maven	5.8.16 up to 5.8.16-tuxcare.15, plus listed versions 5.8.16-tuxcare.105.8.16-tuxcare.115.8.16-tuxcare.125.8.16-tuxcare.135.8.16-tuxcare.14 Show 10 moreShow less 5.8.16-tuxcare.45.8.16-tuxcare.55.8.16-tuxcare.65.8.16-tuxcare.75.8.16-tuxcare.85.8.16-tuxcare.95.8.16.tuxcare5.8.16.tuxcare.15.8.16.tuxcare.25.8.16.tuxcare.3	5.8.16-tuxcare.15
`org.springframework.security:spring-security-ldap` TuxCare:Maven	5.8.14 up to 5.8.14-tuxcare.2, plus listed versions 5.8.14-tuxcare.1	5.8.14-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven	6.3.10 up to 6.3.10-tuxcare.19, plus listed versions 6.3.10-tuxcare.16.3.10-tuxcare.106.3.10-tuxcare.116.3.10-tuxcare.126.3.10-tuxcare.13 Show 13 moreShow less 6.3.10-tuxcare.146.3.10-tuxcare.156.3.10-tuxcare.166.3.10-tuxcare.176.3.10-tuxcare.186.3.10-tuxcare.26.3.10-tuxcare.36.3.10-tuxcare.46.3.10-tuxcare.56.3.10-tuxcare.66.3.10-tuxcare.76.3.10-tuxcare.86.3.10-tuxcare.9	6.3.10-tuxcare.19
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 4 CVEs	6.4.3 up to 6.4.3-tuxcare.10, plus listed versions 6.4.3-tuxcare.16.4.3-tuxcare.26.4.3-tuxcare.36.4.3-tuxcare.46.4.3-tuxcare.5 Show 4 moreShow less 6.4.3-tuxcare.66.4.3-tuxcare.76.4.3-tuxcare.86.4.3-tuxcare.9	6.4.3-tuxcare.10
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 4 CVEs	6.4.3 up to 6.4.3-tuxcare.10, plus listed versions 6.4.3-tuxcare.16.4.3-tuxcare.26.4.3-tuxcare.36.4.3-tuxcare.46.4.3-tuxcare.5 Show 4 moreShow less 6.4.3-tuxcare.66.4.3-tuxcare.76.4.3-tuxcare.86.4.3-tuxcare.9	6.4.3-tuxcare.10

Show 65 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 4 CVEs	6.4.3 up to 6.4.3-tuxcare.10, plus listed versions 6.4.3-tuxcare.16.4.3-tuxcare.26.4.3-tuxcare.36.4.3-tuxcare.46.4.3-tuxcare.5 Show 4 moreShow less 6.4.3-tuxcare.66.4.3-tuxcare.76.4.3-tuxcare.86.4.3-tuxcare.9	6.4.3-tuxcare.10
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 4 CVEs	6.4.3 up to 6.4.3-tuxcare.10, plus listed versions 6.4.3-tuxcare.16.4.3-tuxcare.26.4.3-tuxcare.36.4.3-tuxcare.46.4.3-tuxcare.5 Show 4 moreShow less 6.4.3-tuxcare.66.4.3-tuxcare.76.4.3-tuxcare.86.4.3-tuxcare.9	6.4.3-tuxcare.10
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	6.0.8 up to 6.0.8-tuxcare.4, plus listed versions 6.0.8-tuxcare.16.0.8-tuxcare.26.0.8-tuxcare.3	6.0.8-tuxcare.4
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	6.2.2 up to 6.2.2-tuxcare.8, plus listed versions 6.2.2-tuxcare.16.2.2-tuxcare.26.2.2-tuxcare.36.2.2-tuxcare.46.2.2-tuxcare.56.2.2-tuxcare.66.2.2-tuxcare.7	6.2.2-tuxcare.8
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	6.2.2 up to 6.2.2-tuxcare.8, plus listed versions 6.2.2-tuxcare.16.2.2-tuxcare.26.2.2-tuxcare.36.2.2-tuxcare.46.2.2-tuxcare.56.2.2-tuxcare.66.2.2-tuxcare.7	6.2.2-tuxcare.8
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 3 CVEs	6.2.2 up to 6.2.2-tuxcare.8, plus listed versions 6.2.2-tuxcare.16.2.2-tuxcare.26.2.2-tuxcare.36.2.2-tuxcare.46.2.2-tuxcare.56.2.2-tuxcare.66.2.2-tuxcare.7	6.2.2-tuxcare.8
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	6.2.7 up to 6.2.7-tuxcare.7, plus listed versions 6.2.7-tuxcare.16.2.7-tuxcare.26.2.7-tuxcare.36.2.7-tuxcare.46.2.7-tuxcare.56.2.7-tuxcare.6	6.2.7-tuxcare.7
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	6.2.7 up to 6.2.7-tuxcare.7, plus listed versions 6.2.7-tuxcare.16.2.7-tuxcare.26.2.7-tuxcare.36.2.7-tuxcare.46.2.7-tuxcare.56.2.7-tuxcare.6	6.2.7-tuxcare.7
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 3 CVEs	6.2.7 up to 6.2.7-tuxcare.7, plus listed versions 6.2.7-tuxcare.16.2.7-tuxcare.26.2.7-tuxcare.36.2.7-tuxcare.46.2.7-tuxcare.56.2.7-tuxcare.6	6.2.7-tuxcare.7
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	6.3.9 up to 6.3.9-tuxcare.2, plus listed versions 6.3.9-tuxcare.1	6.3.9-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	6.3.9 up to 6.3.9-tuxcare.2, plus listed versions 6.3.9-tuxcare.1	6.3.9-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 3 CVEs	6.3.9 up to 6.3.9-tuxcare.2, plus listed versions 6.3.9-tuxcare.1	6.3.9-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	6.2.8 up to 6.2.8-tuxcare.5, plus listed versions 6.2.8-tuxcare.16.2.8-tuxcare.26.2.8-tuxcare.36.2.8-tuxcare.4	6.2.8-tuxcare.5
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	6.2.8 up to 6.2.8-tuxcare.5, plus listed versions 6.2.8-tuxcare.16.2.8-tuxcare.26.2.8-tuxcare.36.2.8-tuxcare.4	6.2.8-tuxcare.5
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 3 CVEs	6.2.8 up to 6.2.8-tuxcare.5, plus listed versions 6.2.8-tuxcare.16.2.8-tuxcare.26.2.8-tuxcare.36.2.8-tuxcare.4	6.2.8-tuxcare.5
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 15 CVEs	6.0.7 up to 6.0.7-tuxcare.1	6.0.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7	6.1.6-tuxcare.8
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7	6.1.6-tuxcare.8
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 6 CVEs	6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7	6.1.6-tuxcare.8
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 6 CVEs	6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7	6.1.6-tuxcare.8
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	6.1.6 up to 6.1.6-tuxcare.8, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.56.1.6-tuxcare.66.1.6-tuxcare.7	6.1.6-tuxcare.8
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 11 CVEs	5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1	5.8.15-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-saml2-service-provider` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 10 CVEs	5.6.7 up to 5.6.7-tuxcare.1	5.6.7-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	5.7.7 up to 5.7.7-tuxcare.2, plus listed versions 5.7.7-tuxcare.1	5.7.7-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	5.7.7 up to 5.7.7-tuxcare.2, plus listed versions 5.7.7-tuxcare.1	5.7.7-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 3 CVEs	5.7.7 up to 5.7.7-tuxcare.2, plus listed versions 5.7.7-tuxcare.1	5.7.7-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	5.6.9 up to 5.6.9-tuxcare.2, plus listed versions 5.6.9-tuxcare.1	5.6.9-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	5.6.9 up to 5.6.9-tuxcare.2, plus listed versions 5.6.9-tuxcare.1	5.6.9-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 3 CVEs	5.6.9 up to 5.6.9-tuxcare.2, plus listed versions 5.6.9-tuxcare.1	5.6.9-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 4 CVEs	5.6.10 up to 5.6.10-tuxcare.8, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.45.6.10-tuxcare.55.6.10-tuxcare.65.6.10-tuxcare.7	5.6.10-tuxcare.8
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 4 CVEs	5.6.10 up to 5.6.10-tuxcare.8, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.45.6.10-tuxcare.55.6.10-tuxcare.65.6.10-tuxcare.7	5.6.10-tuxcare.8
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 4 CVEs	5.6.10 up to 5.6.10-tuxcare.8, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.45.6.10-tuxcare.55.6.10-tuxcare.65.6.10-tuxcare.7	5.6.10-tuxcare.8
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 4 CVEs	5.6.10 up to 5.6.10-tuxcare.8, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.45.6.10-tuxcare.55.6.10-tuxcare.65.6.10-tuxcare.7	5.6.10-tuxcare.8
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 3 CVEs	5.5.8 up to 5.5.8-tuxcare.2, plus listed versions 5.5.8-tuxcare.1	5.5.8-tuxcare.2
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 3 CVEs	5.5.8 up to 5.5.8-tuxcare.2, plus listed versions 5.5.8-tuxcare.1	5.5.8-tuxcare.2
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 3 CVEs	5.5.8 up to 5.5.8-tuxcare.2, plus listed versions 5.5.8-tuxcare.1	5.5.8-tuxcare.2
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 8 CVEs	5.1.5.RELEASE up to 5.1.5.RELEASE-tuxcare.1	5.1.5.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 6 CVEs	5.1.4.RELEASE up to 5.1.4.RELEASE-tuxcare.1	5.1.4.RELEASE-tuxcare.1
`org.springframework.security:spring-security-bom` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-core` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-crypto` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-ldap` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1
`org.springframework.security:spring-security-web` TuxCare:Maven From an advisory covering 9 CVEs	5.1.6.RELEASE up to 5.1.6.RELEASE-tuxcare.1	5.1.6.RELEASE-tuxcare.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59270 is a critical vulnerability (CVSS 9.4) in Spring Security, published August 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in org.springframework.security:spring-security-ldap 5.7.14-tuxcare.6.

References