CVE-2026-59277
Description
Spring Security InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal (private) or external (public) network.
In Spring Security 7.1.0, the internal address classification did not recognize the IPv4 and IPv6 any local addresses (0.0.0.0 and ::) as internal. As a result, matchExternal() incorrectly classified these addresses as external, and matchInternal() failed to classify them as internal.
Statement
A flaw was found in Spring Security 7.1.0 where the InetAddressMatchers utility does not correctly classify IPv4 and IPv6 "any local" addresses (0.0.0.0 and ::) as internal network addresses. Applications that rely on matchInternal() or matchExternal() for IP-based access control may incorrectly treat these addresses as external, potentially allowing unauthorized read access to resources intended for internal networks only.
Red Hat OpenShift Jenkins (ocp-tools) in Red Hat OpenShift Container Platform 4.20 includes Spring Security 7.1.0 and is affected. Other Red Hat Hybrid Platforms products evaluated for this flaw, including Red Hat OpenShift Dev Spaces, do not include the affected Spring Security version and are not affected.
Mitigation
Mitigation for this issue is either not available or does not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation use cases, and the lack of negative side effects to extended use. For the above product(s), Red Hat recommends that customers evaluate each potential workaround as part of their own risk assessment.
Upstream fix: upgrade Spring Security to 7.1.1 or later.
Workaround: replace InetAddressMatchers.matchInternal() or matchExternal() usage with explicit CIDR-based IpAddressMatcher rules for the private ranges your deployment requires (for example 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.7 | 5.3 | 3.7 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | Low | High |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | Low | Low | Low |
| Integrity Impact | None | None | None |
| Availability Impact | None | None | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Attackers may be able to find other malicious inputs that were not expected by the developer, allowing them to bypass the intended protection mechanism.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
