The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks.
Affected versions:
Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Spring |
|
| Vmware |
|
No data.
References
| Link | Providers |
|---|---|
| https://spring.io/security/cve-2026-40969 |
|
History
Thu, 30 Apr 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Vmware
Vmware spring Grpc |
|
| CPEs | cpe:2.3:a:vmware:spring_grpc:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Vmware
Vmware spring Grpc |
Wed, 29 Apr 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Spring
Spring spring |
|
| Vendors & Products |
Spring
Spring spring |
Tue, 28 Apr 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected. | |
| Title | Spring gRPC AuthenticationException message reflected to remote client | |
| Weaknesses | CWE-209 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: vmware
Published:
Updated: 2026-04-28T17:21:36.495Z
Reserved: 2026-04-16T02:18:56.133Z
Link: CVE-2026-40969
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2026-04-28T15:16:30.560
Modified: 2026-04-30T13:24:42.033
Link: CVE-2026-40969
Redhat
No data.