Back spring.io

Cve 2026 59270

spring.io • August 24, 2026

Spring Security's embedded UnboundID LDAP server ( UnboundIdContainer ) unconditionally registers an administrative credential and binds its listener to all available network interfaces.

An attacker who could reach the LDAP listener port could authenticate using the well-known administrative bind DN, and then read or modify entries in the in-memory directory.

No further mitigation steps are necessary.

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Check out all the upcoming events in the Spring community.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in VMware Tanzu Spring Software Expose Admin Access VMware Tanzu Spring software has multiple security vulnerabilities requiring urgent updates. A critical LDAP flaw (CVE-2026-59270) can grant attackers administrator access, allowing them to alter user identities. Other vulnerabilities affect Spring Security, Spring AI, and Spring GraphQL, with CVEs rated high for potential exploitation. No confirmed exploitation has been reported as of now. Administrators are advised to review the Spring website for specific details on affected versions and patches. The vulnerabilities are primarily rated as medium, with one critical and several high-risk issues identified. CERT-Bund has also reported multiple denial-of-service flaws in the Spring Framework. The situation remains serious, necessitating immediate attention from system administrators. 2 sources 71

Extracted Entities

Cve 2026 59270

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (4)