Description

Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-08-27T06:17:21.223Z",
  "pubdate": "2026-08-27T06:17:21.223Z",
  "executiveSummary": "A significant security vulnerability exists within the UnboundIdContainer component used in Spring Security, characterized by insecure default configurations.\nThe vulnerability involves the unconditional registration of administrative credentials alongside the binding of the embedded LDAP listener to all available network interfaces.\nThis combination creates a critical exposure where an unauthorized remote attacker can interact with the LDAP server from any network path, potentially leveraging the pre-configured administrative credentials to gain unauthorized access.\nThe flaw impacts multiple Spring Security versions, including 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18, and 5.8.0-5.8.27, as well as 5.7.0-5.7.25.\nThe risk implication is severe, as it facilitates potential system compromise, unauthorized data access, and unauthorized administrative control over the LDAP service without requiring prior authentication or complex exploitation chains.\nAttackers can leverage this exposure by identifying target systems with active LDAP listeners and attempting to authenticate using known or predictable administrative credentials inherent to the container's default configuration.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the UnboundIdContainer within Spring Security, which fails to enforce secure defaults during the initialization of the embedded UnboundID LDAP server.\nSpecifically, the component unconditionally registers administrative credentials upon startup and binds the LDAP listener socket to the wildcard address (0.0.0.0), effectively exposing the service to all accessible network interfaces, including external ones.\nBecause the administrative credentials are registered without optionality or restriction, the LDAP service operates in a high-privilege state by default.\nThe attack flow begins with an attacker performing network reconnaissance to identify reachable LDAP services on the targeted infrastructure. Once identified, an attacker can initiate a bind request to the embedded LDAP listener.\nSince the listener is bound to all interfaces and utilizes pre-registered administrative credentials, the attacker can supply these credentials to establish an authenticated administrative session.\nThe vulnerable component, UnboundIdContainer, is used primarily in testing or development environments to provide an embedded LDAP store. However, if these environments are not properly isolated or if the container is inadvertently included in production configurations, the security boundary is bypassed.\nExploitation requires no complex vulnerability chaining or memory corruption; it is a configuration-based flaw that grants an attacker immediate elevated access. Upon successful connection, the attacker can perform arbitrary LDAP operations, including reading sensitive directory entries, modifying user attributes, or altering access control configurations.\nThe impact is a full compromise of the LDAP directory service provided by the container. This can be used as a pivot point for further network movement, credential harvesting, or denial-of-service, depending on the role the LDAP server plays within the application architecture.\nThe affected versions include broad ranges across the 5.x, 6.x, and 7.x branches of Spring Security, indicating that the insecure initialization pattern was deeply embedded in the framework's testing utilities for an extended period."
}