Vulnerability · Published Apr 28, 2026 · Assigned by vmware
CVE-2026-40968Spring gRPC SecurityContext leaks across requests on authorization failure
Medium 4.3
In plain English
A medium-severity security flaw in Spring gRPC from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.grpc:spring-grpc | 1.0.3 | GHSA-4g9c-3x4p-mfpp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring gRPC | 1.0.0 – before 1.0.3 |
Weakness: CWE-653 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N