PT-2026-35730 · Spring · Spring Grpc

Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-40968

Mitre

CVSS v3.1

4.2

Medium

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions.

Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

Fix

Weakness Enumeration

CWE-653

Related Identifiers

CVE-2026-40968

Affected Products

Spring Grpc

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-40968 · Security Note
• https://spring.io/security/cve-2026-40968 · Note