CVE-2026-59270: CWE-798 Use of Hard-coded Credentials in Spring Spring Security

Spring Security's embedded UnboundID LDAP server component (UnboundIdContainer) contains a hard-coded administrative credential that is registered unconditionally. Additionally, the LDAP listener binds to all available network interfaces, increasing exposure. This vulnerability affects specific versions of Spring Security: 5.7.0 through 5.8.27, 6.4.0 through 6.4.18, 6.5.0 through 6.5.11, 7.0.0 through 7.0.6, and exactly 7.1.0. The CVSS 3.1 score is 9.4 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and low impact on availability. No official remediation or patch information is provided in the source data, and no known exploits are reported in the wild as of the publication date.

The vulnerability allows an attacker to potentially gain unauthorized administrative access via the hard-coded credentials in the embedded LDAP server. Because the LDAP listener binds to all network interfaces, the attack surface is broad, increasing the risk of remote exploitation. Successful exploitation could lead to full compromise of confidentiality and integrity of the affected system, with some impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is provided in the available data. Users should monitor official Spring Security advisories for updates and consider restricting network exposure of the embedded LDAP server until a patch is available.