CVE-2026-40968— Spring gRPC SecurityContext leaks across requests on authorization failure
Quick assessment
Affected
Spring Spring gRPC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Vmware Spring gRPC是美国威睿（Vmware）公司的一个支持gRPC通信的Spring应用开发扩展组件。 Vmware Spring gRPC 1.0.0至1.0.2版本存在安全漏洞，该漏洞源于认证用户被拒绝访问gRPC方法时，其认证身份仍绑定到gRPC工作线程，可能被后续同一线程上的未认证请求继承，导致权限提升。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-40968
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spring gRPC SecurityContext leaks across requests on authorization failure
Source: CVE Program / CVE List V5
Vulnerability Description
When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions.
Affected versions:
Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的划分
Source: CVE Program / CVE List V5
Vulnerability Title
Vmware Spring gRPC 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Vmware Spring gRPC是美国威睿（Vmware）公司的一个支持gRPC通信的Spring应用开发扩展组件。 Vmware Spring gRPC 1.0.0至1.0.2版本存在安全漏洞，该漏洞源于认证用户被拒绝访问gRPC方法时，其认证身份仍绑定到gRPC工作线程，可能被后续同一线程上的未认证请求继承，导致权限提升。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring gRPC | 1.0.0 ~ 1.0.3 | - |
|
II. Public POCs for CVE-2026-40968
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40968
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-40968 (1)
Same Patch Batch · Spring · 2026-04-28 · 6 CVEs total
| CVE-2026-40978 | 8.8 HIGH | VMware Spring AI SQL注入漏洞 |
| CVE-2026-40967 | 8.6 HIGH | VMware Spring AI 代码注入漏洞 |
| CVE-2026-40980 | 6.5 MEDIUM | VMware Spring AI 资源管理错误漏洞 |
| CVE-2026-40979 | 6.1 MEDIUM | VMware Spring AI 安全漏洞 |
| CVE-2026-40969 | 3.7 LOW | Spring gRPC AuthenticationException message reflected to remote client |
IV. Related Vulnerabilities
Same vendor: Spring
-
CVE-2026-59318
DefaultToolCallingManager Global Resolver Fallback Allows Un -
CVE-2026-59308
Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Tru -
CVE-2026-59279
Unbounded persistent session allocation via repeated initial -
CVE-2026-59326
HTTP Proxy Credentials Logged in Plaintext by the Spring Boo -
CVE-2026-59328
Cross-Site Scripting in Eclipse Spring Boot Starter Wizard D
Same weakness: CWE-653
-
CVE-2026-71325
Traefik: `allowCrossNamespace=false` bypass via `@kubernetes -
CVE-2026-65635
Boruta dynamic client registration allows creation of over-p -
CVE-2026-53421
Apache Syncope: Remote Code Execution via Scripted Connector -
CVE-2026-53405
Apache Syncope: Remote Code Execution via Flowable BPMN Groo -
CVE-2026-63071
Apache Syncope: RCE via Groovy Sandbox bypass
V. Comments for CVE-2026-40968
No comments yet