What is the CVSS score of EUVD-2026-26054?

EUVD-2026-26054 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-26054?

Yes, a patch is available for EUVD-2026-26054. Update the affected software to the latest version immediately.

Spring gRPC EUVD-2026-26054

| CVE-2026-40968 MEDIUM

Improper Isolation or Compartmentalization (CWE-653)

2026-04-28 vmware

Java Privilege Escalation

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 30, 2026 - 13:32 nvd

Patch available

Apr 28, 2026 - 16:02 EUVD

CVSS changed

Apr 28, 2026 - 15:22 NVD

4.3 (MEDIUM) 4.2 (MEDIUM)

Analysis Generated

Apr 28, 2026 - 15:00 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 14:30 euvd

EUVD-2026-26054

Analysis Generated

Apr 28, 2026 - 14:30 vuln.today

CVE Published

Apr 28, 2026 - 13:42 nvd

MEDIUM 4.2

DescriptionCVE.org

When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions.

Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

AnalysisAI

Spring gRPC 1.0.0 through 1.0.2 inherits authenticated user identity on gRPC worker threads after access denial, allowing a subsequent unauthenticated request on the same thread to gain escalated permissions. The vulnerability requires an authenticated attacker with prior knowledge of thread reuse patterns and affects only configurations where both authenticated and unauthenticated requests share gRPC worker threads. A patch is available in version 1.0.3.

Technical ContextAI

Spring gRPC implements remote procedure call (RPC) handlers using Java worker threads. When a gRPC method denies access to an authenticated user, the vulnerability lies in insufficient context cleanup (CWE-653: Missing Zero-Byte Check Before Using Data) where the authenticated identity object remains bound to the ThreadLocal storage of the worker thread. Subsequent unauthenticated requests routed to the same thread inherit this identity without re-validation, bypassing authorization checks. The affected CPE is cpe:2.3:a:spring:spring_grpc:*:*:*:*:*:*:*:*, indicating all Spring gRPC packages with versions below 1.0.3 are susceptible.

RemediationAI

Upgrade Spring gRPC to version 1.0.3 or later; this is the vendor-released patch that restores proper context cleanup on worker threads. For systems unable to upgrade immediately, implement explicit authentication context validation at the start of every gRPC handler method, using Spring Security's @PreAuthorize or custom SecurityContext checks to verify the authenticated principal matches the current request's credentials rather than relying on ThreadLocal state. Additionally, consider configuring gRPC worker thread pools to terminate and recreate threads after each request (rather than reusing them) by setting appropriate thread pool lifecycle policies, though this carries a performance trade-off. Monitor application logs for authentication mismatch errors that may indicate exploitation attempts. Do not rely on request filtering alone; the vulnerability is in the framework's thread management.