Low severity3.7NVD Advisory· Published Apr 28, 2026· Updated Apr 30, 2026
CVE-2026-40969
CVE-2026-40969
Description
The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks.
Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.springframework.grpc:spring-grpcMaven | < 1.0.3 | 1.0.3 |
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-37w2-q6vh-45v6ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-40969ghsaADVISORY
- spring.io/security/cve-2026-40969nvdVendor AdvisoryWEB
News mentions
0No linked articles in our index yet.