CVE-2026-40969

The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://spring.io/security/cve-2026-40969	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:vmware:spring_grpc:*:*:*:*:*:*:*:*

History

26 Oct 2026, 00:10

Type	Values Removed	Values Added
Summary		(es) El mensaje sin procesar de cada Excepción de autenticación del lado del servidor se devuelve al llamador remoto no autenticado en la descripción de estado de gRPC. Esto permite a un atacante obtener información sobre el fallo de autenticación, lo cual puede ser útil para ataques posteriores. Versiones afectadas: Spring gRPC: 1.0.0 - 1.0.2 (corregido en 1.0.3). Las versiones anteriores y no compatibles también están afectadas.

Information

Published : 2026-04-28 15:16

Updated : 2026-10-26 00:10

NVD link : CVE-2026-40969

Mitre link : CVE-2026-40969

CVE.ORG link : CVE-2026-40969

JSON object : View

Products Affected

vmware

spring_grpc

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2026-40969", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40969", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-28T17:21:24.098415Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "Spring", "product": "Spring gRPC", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.3", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-28T15:16:30.560", "references": [{"url": "https://spring.io/security/cve-2026-40969", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@vmware.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks.\n\nAffected versions:\nSpring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected."}, {"lang": "es", "value": "El mensaje sin procesar de cada Excepci\u00f3n de autenticaci\u00f3n del lado del servidor se devuelve al llamador remoto no autenticado en la descripci\u00f3n de estado de gRPC. Esto permite a un atacante obtener informaci\u00f3n sobre el fallo de autenticaci\u00f3n, lo cual puede ser \u00fatil para ataques posteriores.\n\nVersiones afectadas:\nSpring gRPC: 1.0.0 - 1.0.2 (corregido en 1.0.3). Las versiones anteriores y no compatibles tambi\u00e9n est\u00e1n afectadas."}], "lastModified": "2026-10-26T00:10:00.150", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_grpc:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4B816748-EE94-4935-A81F-E9542FB2E3D2", "versionEndExcluding": "1.0.3"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}