CVE-2026-40969
- Source
- https://cve.org/CVERecord?id=CVE-2026-40969
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40969.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-40969
- Aliases
- Published
- 2026-04-28T14:54:07.360Z
- Modified
- 2026-08-12T03:51:25.602027959Z
- Severity
-
- 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Spring gRPC AuthenticationException message reflected to remote client
- Details
-
The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks.
Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
- Database specific
{ "cna_assigner": "vmware", "cwe_ids": [ "CWE-209" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40969.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "1.0.0" }, { "fixed": "1.0.3" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/spring-projects/spring-grpc
Affected ranges
- Type
- GIT
- Repo
- https://github.com/spring-projects/spring-grpc
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "introduced": "0" }, { "fixed": "1.0.3" } ], "source": "CPE_RANGE", "cpe": "cpe:2.3:a:vmware:spring_grpc:*:*:*:*:*:*:*:*" }