{"id":"CVE-2026-59270","aliases":["CLSA-2026-1787919833","CLSA-2026-1787929170","CLSA-2026-1788251580","CLSA-2026-1788333969","CLSA-2026-1789407633","CLSA-2026-1789410116","CLSA-2026-1790789961","CLSA-2026-1791997778","CLSA-2026-1792063694","CLSA-2026-1792077066","CLSA-2026-1792077163","CLSA-2026-1792077209","CLSA-2026-1792077256","CLSA-2026-1792077565","CLSA-2026-1792079446","CLSA-2026-1792079757","CLSA-2026-1792084952","CLSA-2026-1792089227","CLSA-2026-1792089645","CLSA-2026-1792099521","CLSA-2026-1792099598","CLSA-2026-1792099763","CLSA-2026-1792102802","CLSA-2026-1792502421","CLSA-2026-1792503291","CLSA-2026-1794175722","CLSA-2026-1794189026","CLSA-2026-1794189800","CLSA-2026-1794244725","CLSA-2026-1794245422","CLSA-2026-1794246204","EUVD-2026-66846","GHSA-rhjh-84m4-5qg7"],"status":"published","title":"Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces","description":"Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","severity":{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00404,"percentile":0.35164,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2026-08-27T05:20:33Z","modified":"2026-11-10T01:15:04Z","fixes":[{"ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","fixed_in":["5.7.14-tuxcare.6","5.7.11-tuxcare.8","6.5.11-tuxcare.1","6.4.13-tuxcare.4","5.7.12-tuxcare.9","5.8.16-tuxcare.15","5.8.14-tuxcare.2","6.3.10-tuxcare.19"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.14"},{"fixed":"5.7.14-tuxcare.6"}]}],"versions":["5.7.14","5.7.14-tuxcare.1","5.7.14-tuxcare.2","5.7.14-tuxcare.3","5.7.14-tuxcare.4","5.7.14-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.11"},{"fixed":"5.7.11-tuxcare.8"}]}],"versions":["5.7.11","5.7.11-tuxcare.1","5.7.11-tuxcare.2","5.7.11-tuxcare.3","5.7.11-tuxcare.4","5.7.11-tuxcare.5","5.7.11-tuxcare.6","5.7.11-tuxcare.7","5.7.11.tuxcare"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.5.11"},{"fixed":"6.5.11-tuxcare.1"}]}],"versions":["6.5.11"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.13"},{"fixed":"6.4.13-tuxcare.4"}]}],"versions":["6.4.13","6.4.13-tuxcare.1","6.4.13-tuxcare.2","6.4.13-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.12"},{"fixed":"5.7.12-tuxcare.9"}]}],"versions":["5.7.12","5.7.12-tuxcare.1","5.7.12-tuxcare.2","5.7.12-tuxcare.3","5.7.12-tuxcare.4","5.7.12-tuxcare.5","5.7.12-tuxcare.6","5.7.12-tuxcare.7","5.7.12-tuxcare.8"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.16"},{"fixed":"5.8.16-tuxcare.15"}]}],"versions":["5.8.16","5.8.16-tuxcare.10","5.8.16-tuxcare.11","5.8.16-tuxcare.12","5.8.16-tuxcare.13","5.8.16-tuxcare.14","5.8.16-tuxcare.4","5.8.16-tuxcare.5","5.8.16-tuxcare.6","5.8.16-tuxcare.7","5.8.16-tuxcare.8","5.8.16-tuxcare.9","5.8.16.tuxcare","5.8.16.tuxcare.1","5.8.16.tuxcare.2","5.8.16.tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.14"},{"fixed":"5.8.14-tuxcare.2"}]}],"versions":["5.8.14","5.8.14-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.10"},{"fixed":"6.3.10-tuxcare.19"}]}],"versions":["6.3.10","6.3.10-tuxcare.1","6.3.10-tuxcare.10","6.3.10-tuxcare.11","6.3.10-tuxcare.12","6.3.10-tuxcare.13","6.3.10-tuxcare.14","6.3.10-tuxcare.15","6.3.10-tuxcare.16","6.3.10-tuxcare.17","6.3.10-tuxcare.18","6.3.10-tuxcare.2","6.3.10-tuxcare.3","6.3.10-tuxcare.4","6.3.10-tuxcare.5","6.3.10-tuxcare.6","6.3.10-tuxcare.7","6.3.10-tuxcare.8","6.3.10-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.4.3"},{"fixed":"6.4.3-tuxcare.10"}]}],"versions":["6.4.3","6.4.3-tuxcare.1","6.4.3-tuxcare.2","6.4.3-tuxcare.3","6.4.3-tuxcare.4","6.4.3-tuxcare.5","6.4.3-tuxcare.6","6.4.3-tuxcare.7","6.4.3-tuxcare.8","6.4.3-tuxcare.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.8"},{"fixed":"6.0.8-tuxcare.4"}]}],"versions":["6.0.8","6.0.8-tuxcare.1","6.0.8-tuxcare.2","6.0.8-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.8"}]}],"versions":["6.2.2","6.2.2-tuxcare.1","6.2.2-tuxcare.2","6.2.2-tuxcare.3","6.2.2-tuxcare.4","6.2.2-tuxcare.5","6.2.2-tuxcare.6","6.2.2-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.8"}]}],"versions":["6.2.2","6.2.2-tuxcare.1","6.2.2-tuxcare.2","6.2.2-tuxcare.3","6.2.2-tuxcare.4","6.2.2-tuxcare.5","6.2.2-tuxcare.6","6.2.2-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.2"},{"fixed":"6.2.2-tuxcare.8"}]}],"versions":["6.2.2","6.2.2-tuxcare.1","6.2.2-tuxcare.2","6.2.2-tuxcare.3","6.2.2-tuxcare.4","6.2.2-tuxcare.5","6.2.2-tuxcare.6","6.2.2-tuxcare.7"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.7"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2","6.2.7-tuxcare.3","6.2.7-tuxcare.4","6.2.7-tuxcare.5","6.2.7-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.7"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2","6.2.7-tuxcare.3","6.2.7-tuxcare.4","6.2.7-tuxcare.5","6.2.7-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.7"},{"fixed":"6.2.7-tuxcare.7"}]}],"versions":["6.2.7","6.2.7-tuxcare.1","6.2.7-tuxcare.2","6.2.7-tuxcare.3","6.2.7-tuxcare.4","6.2.7-tuxcare.5","6.2.7-tuxcare.6"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.2"}]}],"versions":["6.3.9","6.3.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.2"}]}],"versions":["6.3.9","6.3.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.3.9"},{"fixed":"6.3.9-tuxcare.2"}]}],"versions":["6.3.9","6.3.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.5"}]}],"versions":["6.2.8","6.2.8-tuxcare.1","6.2.8-tuxcare.2","6.2.8-tuxcare.3","6.2.8-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.5"}]}],"versions":["6.2.8","6.2.8-tuxcare.1","6.2.8-tuxcare.2","6.2.8-tuxcare.3","6.2.8-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.8"},{"fixed":"6.2.8-tuxcare.5"}]}],"versions":["6.2.8","6.2.8-tuxcare.1","6.2.8-tuxcare.2","6.2.8-tuxcare.3","6.2.8-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.7"},{"fixed":"6.0.7-tuxcare.1"}]}],"versions":["6.0.7"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.6"},{"fixed":"6.1.6-tuxcare.8"}]}],"versions":["6.1.6","6.1.6-tuxcare.1","6.1.6-tuxcare.2","6.1.6-tuxcare.3","6.1.6-tuxcare.4","6.1.6-tuxcare.5","6.1.6-tuxcare.6","6.1.6-tuxcare.7"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.15"},{"fixed":"5.8.15-tuxcare.2"}]}],"versions":["5.8.15","5.8.15.tuxcare","5.8.15.tuxcare.1"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.7"},{"fixed":"5.6.7-tuxcare.1"}]}],"versions":["5.6.7"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.7"},{"fixed":"5.7.7-tuxcare.2"}]}],"versions":["5.7.7","5.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.7"},{"fixed":"5.7.7-tuxcare.2"}]}],"versions":["5.7.7","5.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.7"},{"fixed":"5.7.7-tuxcare.2"}]}],"versions":["5.7.7","5.7.7-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.9"},{"fixed":"5.6.9-tuxcare.2"}]}],"versions":["5.6.9","5.6.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.9"},{"fixed":"5.6.9-tuxcare.2"}]}],"versions":["5.6.9","5.6.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.9"},{"fixed":"5.6.9-tuxcare.2"}]}],"versions":["5.6.9","5.6.9-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.10"},{"fixed":"5.6.10-tuxcare.8"}]}],"versions":["5.6.10","5.6.10-tuxcare.1","5.6.10-tuxcare.2","5.6.10-tuxcare.3","5.6.10-tuxcare.4","5.6.10-tuxcare.5","5.6.10-tuxcare.6","5.6.10-tuxcare.7"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.8"},{"fixed":"5.5.8-tuxcare.2"}]}],"versions":["5.5.8","5.5.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.8"},{"fixed":"5.5.8-tuxcare.2"}]}],"versions":["5.5.8","5.5.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.8"},{"fixed":"5.5.8-tuxcare.2"}]}],"versions":["5.5.8","5.5.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.5.RELEASE"},{"fixed":"5.1.5.RELEASE-tuxcare.1"}]}],"versions":["5.1.5.RELEASE"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.4.RELEASE"},{"fixed":"5.1.4.RELEASE-tuxcare.1"}]}],"versions":["5.1.4.RELEASE"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.6.RELEASE"},{"fixed":"5.1.6.RELEASE-tuxcare.1"}]}],"versions":["5.1.6.RELEASE"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.5"},{"fixed":"5.6.5-tuxcare.2"}]}],"versions":["5.6.5","5.6.5-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.7.6"},{"fixed":"5.7.6-tuxcare.2"}]}],"versions":["5.7.6","5.7.6-tuxcare.1"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-oauth2-jose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.5"},{"fixed":"6.1.5-tuxcare.3"}]}],"versions":["6.1.5","6.1.5-tuxcare.1","6.1.5-tuxcare.2"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.7"},{"fixed":"5.5.7-tuxcare.2"}]}],"versions":["5.5.7","5.5.7-tuxcare.1"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6.3"},{"fixed":"5.6.3-tuxcare.3"}]}],"versions":["5.6.3","5.6.3-tuxcare.1","5.6.3-tuxcare.2"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.2.RELEASE"},{"fixed":"5.1.2.RELEASE-tuxcare.2"}]}],"versions":["5.1.2.RELEASE","5.1.2.RELEASE-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-crypto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.2.RELEASE"},{"fixed":"5.1.2.RELEASE-tuxcare.2"}]}],"versions":["5.1.2.RELEASE","5.1.2.RELEASE-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.2.RELEASE"},{"fixed":"5.1.2.RELEASE-tuxcare.2"}]}],"versions":["5.1.2.RELEASE","5.1.2.RELEASE-tuxcare.1"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.security:spring-security-web","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.2.RELEASE"},{"fixed":"5.1.2.RELEASE-tuxcare.2"}]}],"versions":["5.1.2.RELEASE","5.1.2.RELEASE-tuxcare.1"],"bundled":8}],"products":[{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://spring.io/security/cve-2026-59270","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59270","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rhjh-84m4-5qg7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59270.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59270","title":"Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces","description":"Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T05:20:33.21Z","modified":"2026-08-28T16:52:28.234Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"cna"}],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-66846","description":"Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T05:20:33Z","modified":"2026-08-28T16:52:28Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T18:01:22.759915Z"}],"ghsa":[{"id":"GHSA-rhjh-84m4-5qg7","title":"Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers...","description":"Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T06:31:35Z","modified":"2026-09-01T21:32:30Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:11:15.292173Z"}],"nvd":[{"id":"CVE-2026-59270","description":"Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T06:17:21.223Z","modified":"2026-09-01T20:36:33.887Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-59270","title":"Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces","description":"Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6\nSpring Security 6.5.0 - 6.5.11\nSpring Security 6.4.0 - 6.4.18\nSpring Security 5.8.0 - 5.8.27\nSpring Security 5.7.0 - 5.7.25","status":"published","published":"2026-08-27T05:20:33.21Z","modified":"2026-10-28T02:31:03.552952757Z","cvss":[{"version":"3.1","score":9.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","level":"critical"}],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"CLSA-2026-1787919833","title":"TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.7.14-tuxcare.6.","status":"published","published":"2026-08-28T12:23:53Z","modified":"2026-10-30T07:30:15.085915385Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1787929170","title":"TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.7.11-tuxcare.8.","status":"published","published":"2026-08-28T14:59:30Z","modified":"2026-10-30T07:30:37.303766313Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788251580","title":"TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 6.5.11-tuxcare.1.","status":"published","published":"2026-09-01T08:33:00Z","modified":"2026-10-30T07:30:37.101160892Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788333969","title":"TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 6.4.13-tuxcare.4.","status":"published","published":"2026-09-02T07:26:09Z","modified":"2026-10-30T07:30:38.127929974Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1789407633","title":"TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.7.12-tuxcare.9.","status":"published","published":"2026-09-14T17:40:33Z","modified":"2026-10-30T07:30:42.513189404Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1789410116","title":"TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.8.16-tuxcare.15.","status":"published","published":"2026-09-14T18:21:56Z","modified":"2026-10-30T07:30:41.711809643Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790789961","title":"TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 5.8.14-tuxcare.2.","status":"published","published":"2026-09-30T17:39:21Z","modified":"2026-10-30T07:30:44.384180377Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791997778","title":"TuxCare security update for org.springframework.security:spring-security-ldap (1 CVE)","description":"TuxCare rebuilt org.springframework.security:spring-security-ldap to address 1 CVE. Fixed in 6.3.10-tuxcare.19.","status":"published","published":"2026-10-14T17:09:38Z","modified":"2026-10-30T07:30:46.662213711Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792063694","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 6.4.3-tuxcare.10.","status":"published","published":"2026-10-15T11:28:14Z","modified":"2026-11-02T19:46:28.434183651Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077066","title":"TuxCare security update for org.springframework.security (8 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 8 CVEs. Fixed in 6.0.8-tuxcare.4.","status":"published","published":"2026-10-15T15:11:06Z","modified":"2026-11-02T19:46:28.9424175Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077163","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.2-tuxcare.8.","status":"published","published":"2026-10-15T15:12:43Z","modified":"2026-11-02T19:46:28.623455684Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077209","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.7-tuxcare.7.","status":"published","published":"2026-10-15T15:13:29Z","modified":"2026-11-02T19:46:28.620433693Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077256","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.3.9-tuxcare.2.","status":"published","published":"2026-10-15T15:14:16Z","modified":"2026-11-02T19:46:28.579558243Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792077565","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.8-tuxcare.5.","status":"published","published":"2026-10-15T15:19:25Z","modified":"2026-11-02T19:46:28.960783721Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792079446","title":"TuxCare security update for org.springframework.security (15 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.","status":"published","published":"2026-10-15T15:50:46Z","modified":"2026-11-02T19:46:28.625713718Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792079757","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 6 CVEs. Fixed in 6.1.6-tuxcare.8.","status":"published","published":"2026-10-15T15:55:57Z","modified":"2026-11-02T19:46:28.788534029Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792084952","title":"TuxCare security update for org.springframework.security (11 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.","status":"published","published":"2026-10-15T17:22:32Z","modified":"2026-11-02T19:46:29.285657098Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792089227","title":"TuxCare security update for org.springframework.security (10 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.","status":"published","published":"2026-10-15T18:33:47Z","modified":"2026-11-02T19:46:29.416522144Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792089645","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.7-tuxcare.2.","status":"published","published":"2026-10-15T18:40:45Z","modified":"2026-11-02T19:46:29.390355178Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099521","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.6.9-tuxcare.2.","status":"published","published":"2026-10-15T21:25:21Z","modified":"2026-11-02T19:46:29.454294553Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099598","title":"TuxCare security update for org.springframework.security (4 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.8.","status":"published","published":"2026-10-15T21:26:38Z","modified":"2026-11-02T19:46:29.49264102Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792099763","title":"TuxCare security update for org.springframework.security (3 CVEs)","description":"TuxCare rebuilt 3 org.springframework.security packages to address 3 CVEs. Fixed in 5.5.8-tuxcare.2.","status":"published","published":"2026-10-15T21:29:23Z","modified":"2026-11-02T19:46:29.493416528Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792102802","title":"TuxCare security update for org.springframework.security (8 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.5.RELEASE-tuxcare.1.","status":"published","published":"2026-10-15T22:20:02Z","modified":"2026-11-02T19:46:29.511023688Z","updated_at":"2026-11-02T20:29:06.487335Z"},{"id":"CLSA-2026-1792502421","title":"TuxCare security update for org.springframework.security (6 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 5.1.4.RELEASE-tuxcare.1.","status":"published","published":"2026-10-20T13:20:21Z","modified":"2026-11-02T19:46:29.604257702Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792503291","title":"TuxCare security update for org.springframework.security (9 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 9 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.1.","status":"published","published":"2026-10-20T13:34:51Z","modified":"2026-11-02T19:46:29.887116039Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1794175722","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.6.5-tuxcare.2.","status":"published","published":"2026-11-08T23:08:43Z","modified":"2026-11-09T01:45:02.285308078Z","updated_at":"2026-11-09T02:15:19.582074Z"},{"id":"CLSA-2026-1794189026","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 6 org.springframework.security packages to address 14 CVEs. Fixed in 5.7.6-tuxcare.2.","status":"published","published":"2026-11-09T02:50:27Z","modified":"2026-11-09T07:15:04.238231713Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794189800","title":"TuxCare security update for org.springframework.security (14 CVEs)","description":"TuxCare rebuilt 7 org.springframework.security packages to address 14 CVEs. Fixed in 6.1.5-tuxcare.3.","status":"published","published":"2026-11-09T03:03:20Z","modified":"2026-11-09T07:15:04.228555714Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794244725","title":"TuxCare security update for org.springframework.security (13 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.5.7-tuxcare.2.","status":"published","published":"2026-11-09T18:18:46Z","modified":"2026-11-10T01:15:02.463817981Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794245422","title":"TuxCare security update for org.springframework.security (13 CVEs)","description":"TuxCare rebuilt 5 org.springframework.security packages to address 13 CVEs. Fixed in 5.6.3-tuxcare.3.","status":"published","published":"2026-11-09T18:30:22Z","modified":"2026-11-10T01:15:02.483548797Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794246204","title":"TuxCare security update for org.springframework.security (8 CVEs)","description":"TuxCare rebuilt 4 org.springframework.security packages to address 8 CVEs. Fixed in 5.1.2.RELEASE-tuxcare.2.","status":"published","published":"2026-11-09T18:43:25Z","modified":"2026-11-10T01:15:04.343622113Z","updated_at":"2026-11-10T01:43:20.132342Z"}]}}