Loading vulnerability…
AuthenticationException Information Exposure in Spring gRPC
CVE-2026-40969 is an information exposure vulnerability in Spring gRPC affecting versions 1.0.0 through 1.0.2. When server-side authentication fails, the raw message from the AuthenticationException is returned to an unauthenticated remote caller in the gRPC status description. This results in insufficient neutralization of sensitive error information and can disclose internal authentication failure details to external clients. The issue is fixed in Spring gRPC 1.0.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated remote attacker to obtain detailed authentication error information from the server. The disclosed information may reveal aspects of authentication logic, backend configuration, or failure conditions that can assist reconnaissance, credential attacks, security control bypass attempts, or other follow-on attacks. The vulnerability is an information disclosure issue rather than direct code execution or privilege escalation by itself.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure by ensuring authentication failures do not return detailed exception content to remote clients, and configure error handling to emit generic authentication failure responses only. Limit unauthenticated access to exposed gRPC services through network access controls, API gateways, or service mesh policy enforcement where feasible until the fixed version can be deployed.
Patch, then assume compromise.
Upgrade Spring gRPC to version 1.0.3 or later. Versions 1.0.0 through 1.0.2 are affected, and older unsupported versions are also affected. Applying the vendor-provided fixed release is the primary remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.