Spring gRPC CVE-2026-40969

Exploitation requires a gRPC service running Spring gRPC 1.0.0-1.0.2 with Spring Security authentication enabled and exposed to unauthenticated network clients. The vulnerability manifests when an AuthenticationException is raised during the authentication handshake-this is the normal case for failed login attempts. No special configuration or non-default settings are required; the leak occurs in the standard gRPC error-handling path. The high attack complexity likely stems from the need for an attacker to craft requests that trigger meaningful authentication exceptions (e.g., valid endpoint but invalid credentials) rather than requests that fail at the protocol level.

This is a low-impact information disclosure with constrained real-world risk. The CVSS score of 3.7 reflects low severity: attack vector is network (favorable to attacker) but attack complexity is high, privilege requirements are none, and impact is limited to confidentiality (L) with no integrity or availability impact. EPSS data is not provided, limiting exploitation probability assessment. The vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at analysis time. The attack complexity (AC:H) suggests exploitation requires specific conditions-likely triggered only when authentication mechanisms fail in particular ways or when exception messages are particularly revealing. This is a reconnaissance-enabling vulnerability rather than a direct exploitation vector; an attacker learns about the target's authentication architecture rather than gaining access. The fix is available and simple (upgrade to 1.0.3), making this a low-priority remediation window only if the application exposes gRPC services to untrusted networks.

An attacker sends authentication requests to exposed gRPC services and analyzes the returned status descriptions from AuthenticationException failures. If the service uses Spring Security's detailed exception messages (e.g., 'User not found: admin@example.com' or 'LDAP connection timeout'), the attacker gains intel on valid usernames, authentication backends (LDAP, OAuth, custom schemes), or misconfiguration. The attacker then uses this information to tailor brute-force attacks, credential stuffing, or social engineering. High attack complexity may stem from the need to trigger specific exception types or interpret variability in exception messages.