CVE-2026-40968

MediumCVSS 4.2

Published: 28/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

In Spring gRPC 1.0.0 through 1.0.2, when an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread. A subsequent unauthenticated request on the same thread may inherit this identity and gain escalated permissions.

Risk Assessment

An unauthenticated user may assume another user's identity and access gRPC methods with escalated permissions. This poses a serious risk to access control in Spring gRPC-based services.

Recommendation

Update Spring gRPC to version 1.0.3 or later, which patches this vulnerability.

Other vulnerabilities in Spring gRPC

CVE-2026-40969Low
In Spring gRPC, the raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This lets an attacker obtain information about the authentication failure, which may aid further attacks. Versions 1.0.0–1.0.2 are affected (fixed in 1.0.3), as are older unsupported versions.

Original NVD description (English source)

When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS