CVE-2026-40968

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions.

Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-653

Affected software

No affected versions have been published.

Timeline

Published
Apr 28, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-409695.3The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status descriptionCVE-2026-409706.8When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting CVE-2026-409719.1When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to thCVE-2026-409727.5An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote seCVE-2026-409737.0A local attacker on the same host as the application may be able to take control of the directory used by `ApplicationTemp`. When `server.seCVE-2026-409749.8Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra. AffecteCVE-2026-409757.5Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} shoCVE-2026-409769.1In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an applicatioCVE-2026-409776.7When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corruCVE-2026-409788.8SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs.CVE-2026-409796.1In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 CVE-2026-409806.5In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by `ForkPDFLay