PT-2026-35730 · Vmware · Spring Grpc

Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-40968

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring gRPC versions prior to 1.0.3

Description When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread. This identity can be inherited by a subsequent unauthenticated request processed on the same thread, potentially allowing the subsequent user to gain escalated permissions.

Recommendations Update to version 1.0.3.

Fix

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2026-40968

GHSA-4G9C-3X4P-MFPP

Affected Products

Spring Grpc

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-40968 · Security Note
• https://spring.io/security/cve-2026-40968 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4g9c-3x4p-mfpp · Vendor Advisory
• https://github.com/spring-projects/spring-grpc · Note
• https://t.me/CVEtracker/52084 · Telegram Post