What is the CVSS score of CVE-2026-40969?

CVE-2026-40969 has a CVSS 3.1 base score of 3.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40969?

Yes, a patch is available for CVE-2026-40969. Update the affected software to the latest version immediately.

Spring gRPC CVE-2026-40969

EUVD-2026-26064 LOW

Error Message Information Leak (CWE-209)

2026-04-28 security@vmware.com

Information Disclosure Java

3.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.7 LOW

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 30, 2026 - 13:24 nvd

Patch available

Apr 28, 2026 - 17:02 EUVD

Analysis Generated

Apr 28, 2026 - 15:30 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 15:22 euvd

EUVD-2026-26064

Analysis Generated

Apr 28, 2026 - 15:22 vuln.today

CVE Published

Apr 28, 2026 - 15:16 nvd

LOW 3.7

DescriptionCVE.org

The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks.

Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

AnalysisAI

Spring gRPC versions 1.0.0 through 1.0.2 leak sensitive authentication failure details in gRPC status descriptions to unauthenticated remote callers, enabling reconnaissance for follow-up attacks. The vulnerability exposes raw server-side AuthenticationException messages without sanitization, providing attackers with information about authentication mechanisms and potential weaknesses. This low-severity information disclosure (CVSS 3.7) requires high attack complexity but affects default configurations.

Technical ContextAI

Spring gRPC is a Java framework that integrates Spring Security with gRPC services. The vulnerability stems from improper error handling in the gRPC authentication interceptor layer, where AuthenticationException instances are serialized directly into gRPC status descriptions (CWE-209: Information Exposure Through an Error Message). gRPC uses Protocol Buffers and a binary RPC framework; status descriptions are transmitted to all callers, including unauthenticated ones. The root cause is the lack of exception message sanitization before returning to remote clients, contrasting with standard practice of returning generic error messages to untrusted parties.

RemediationAI

Upgrade Spring gRPC to version 1.0.3 or later immediately. Organizations running 1.0.0-1.0.2 should prioritize this patch due to the trivial upgrade path and availability of a vendor-released fix. As a compensating control pending patching, restrict network access to gRPC endpoints to trusted clients only via firewall rules or service mesh policies (e.g., Istio authorization policies). Alternatively, implement a gRPC interceptor that wraps AuthenticationException and returns a generic error message (e.g., 'Authentication failed') instead of exposing the underlying exception details-this adds defense-in-depth but does not replace patching. Review logs for gRPC authentication failures to identify if reconnaissance probing has occurred.