CVE-2026-40969

LowCVSS 3.7

Published: 28/04/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

10th percentile - higher than 10% of all known CVEs

Summary

In Spring gRPC, the raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This lets an attacker obtain information about the authentication failure, which may aid further attacks. Versions 1.0.0–1.0.2 are affected (fixed in 1.0.3), as are older unsupported versions.

Risk Assessment

Disclosing authentication failure details may help an attacker reconnoiter and conduct follow-up attacks against gRPC services.

Recommendation

Update Spring gRPC to version 1.0.3 or later and avoid using unsupported versions.

Other vulnerabilities in Spring gRPC

CVE-2026-40968Medium
In Spring gRPC 1.0.0 through 1.0.2, when an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread. A subsequent unauthenticated request on the same thread may inherit this identity and gain escalated permissions.

Original NVD description (English source)

The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS