CRITICAL🇵🇱 Wersja polska

CVE-2026-59270

CVSS 9.4v3.1pub. 2026-08-27upd. 2026-09-01

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

  • VMware Spring Security

    APP
    Vmware
    5.7.0 – 5.7.26 (excl.)5.8.0 – 5.8.28 (excl.)6.4.0 – 6.4.19 (excl.)6.5.0 – 6.5.12 (excl.)7.0.0 – 7.0.6.1 (excl.)7.1.0 – 7.1.0.1 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Container
CWE
References

Related vulnerabilities

CVE-2026-59354CRITICAL9.6same product

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client R...

CVE-2026-22732CRITICAL9.1PL ✓same product

VMware Spring Security — brak zapisu nagłówków HTTP odpowiedzi

CVE-2023-34034CRITICAL9.1PL ✓same product

Spring Security WebFlux: ominięcie zabezpieczeń przez wzorzec "**"

CVE-2022-31692CRITICAL9.8PL ✓same product

Spring Security: pominięcie reguł autoryzacji przez forward/include dispatcher

CVE-2022-22978CRITICAL9.8PL ✓same product

Obejście autoryzacji w Spring Security przez RegexRequestMatcher

CVE-2026-59270 — Vmware — Spring Security — CRITICAL — CVSS 9.4 | CVEbaza.pl