Loading vulnerability…
Privilege Escalation in Spring gRPC Worker Thread Authentication Context Handling
CVE-2026-40968 is a privilege escalation vulnerability in Spring gRPC affecting versions 1.0.0 through 1.0.2. When an authenticated user attempts to access a gRPC method and access is denied, the authenticated security identity is not properly cleared from the gRPC worker thread. Because the stale authentication context can remain bound to that thread, a subsequent unauthenticated request processed on the same worker thread may inherit the prior user's identity. This results in improper reuse of thread-associated security state across requests and can cause authorization decisions for the later request to be made using the previous authenticated principal.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an unauthenticated or less-privileged requester to inherit the security context of a previously denied authenticated user and obtain elevated permissions. Depending on the privileges associated with the leaked identity and the exposed gRPC methods, this can lead to unauthorized access to protected functionality and compromise of confidentiality and integrity.
If you can’t patch tonight, do this now.
Until upgrades are completed, reduce exposure of affected gRPC services to untrusted clients, enforce compensating controls at upstream authentication and authorization layers where possible, and review application behavior for any reliance on thread-local security context reuse. Because the issue stems from improper cleanup of authentication state on worker threads, mitigation without patching is limited; prompt upgrade is strongly recommended.
Patch, then assume compromise.
Upgrade Spring gRPC to version 1.0.3 or later. Versions 1.0.0 through 1.0.2 are affected, and older unsupported versions are also affected. Applying the vendor-provided fixed release is the primary remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.