CVE-2026-40993

Vulnerability

An attacker with write permissions to the saml2_asserting_party_metadata database table in Spring Security versions 7.0.0 through 7.0.5 may store malicious serialized Java payloads in the verification_credentials and encryption_credentials columns [1].

Exploitation

An attacker requires write access to the database table and needs to inject serialized malicious payloads into the credential columns. When the application reads these rows from the database, the deserialization process can be triggered, leading to code execution [1].

Impact

Successful exploitation allows an attacker to execute code remotely on the server that reads the affected database rows. This can lead to a compromise of the server's confidentiality, integrity, and availability [1].

Mitigation

Users of affected versions should upgrade to Spring Security 7.0.6 or later. If upgrading causes issues, trace logs starting with Failed to deserialize due to ... may provide details. A custom deserializer can be set using AssertingPartyMetadataRowMapper#setCredentialsDeserializer if needed [1].