Medium severity · published Apr 28, 2026
CVE-2026-40969
Spring gRPC AuthenticationException message reflected to remote client
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks.
Affected versions:
Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SG
Spring gRPC · Spring
1.0.0 before 1.0.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40969
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40969
Vendor Advisory
https://spring.io/security/cve-2026-40969
More from Spring gRPC
8.8
CVE-2026-40968
Spring gRPC SecurityContext leaks across requests on authorization failure