CVE-2026-40968: Spring gRPC SecurityContext leaks across requests on authorization failure
When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40968?
CVE-2026-40968 has a medium severity rating due to the potential for unauthorized access via thread context leakage.
How do I fix CVE-2026-40968?
To fix CVE-2026-40968, upgrade to Spring gRPC version 1.0.4 or later.
What types of applications are affected by CVE-2026-40968?
CVE-2026-40968 affects applications using Spring gRPC versions prior to 1.0.4 that employ authorization for gRPC methods.
What is the impact of CVE-2026-40968?
The impact of CVE-2026-40968 includes potential unauthorized access where an authenticated user's identity may be inherited by unauthenticated requests.
Who is responsible for the vulnerability CVE-2026-40968?
The responsibility for addressing CVE-2026-40968 lies with the developers and users of the Spring gRPC framework.