Loading vulnerability…
Empty-password authentication bypass in Spring LDAP
CVE-2026-41720 is an authentication bypass vulnerability in Spring LDAP's DirContextAuthenticationStrategy implementations. These implementations fail to reject bind requests pairing a non-empty username with an empty or null password. RFC 4513 Section 5.1.2 treats this credential combination as an unauthenticated bind. When the LDAP server permits such binds, affected authentication flows can accept a valid username without verifying its password. Authentication through AbstractContextSource, LdapTemplate, and LdapClient is affected. Vulnerable releases include 2.4.0–2.4.4, 3.2.0–3.2.17, 3.3.0–3.3.7, and 4.0.0–4.0.3; unsupported releases are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker may bypass password verification using a valid username and an empty or null password when the backing LDAP server permits unauthenticated binds. Successful exploitation can enable unauthorized access to protected corporate directory assets. The specific scope of accessible data and operations is not established.
If you can’t patch tonight, do this now.
Spring states that no additional mitigation steps are necessary beyond upgrading to a fixed release.
Patch, then assume compromise.
Upgrade Spring LDAP to the fixed release for the deployed branch: 2.4.5, 3.2.18, 3.3.8, or 4.0.4. Versions 2.4.5 and 3.2.18 are available through Enterprise Support; versions 3.3.8 and 4.0.4 are available as open-source releases. Deployments on unsupported branches should migrate to a supported, fixed release. VMware Tanzu GemFire deployments incorporating the affected component should upgrade to 10.1.9.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.