PT-2026-35740 · Vmware · Spring Grpc

Published 2026-04-28 · Updated 2026-04-28 · CVE-2026-40969

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Spring gRPC versions prior to 1.0.3

Description Server-side AuthenticationException raw messages are returned to unauthenticated remote callers within the gRPC status description. This information disclosure allows an attacker to obtain specific details regarding authentication failures, which can be leveraged to facilitate further attacks.

Recommendations Update to version 1.0.3.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-40969

GHSA-37W2-Q6VH-45V6

Affected Products

Spring Grpc

References · 6

• https://spring.io/security/cve-2026-40969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40969 · Security Note
• https://osv.dev/vulnerability/GHSA-37w2-q6vh-45v6 · Vendor Advisory
• https://github.com/spring-projects/spring-grpc · Note
• https://twitter.com/CVEnew/status/2049227565210956128 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2049226699552805074 · Twitter Post