EUVD-2026-35886
GHSA-2q7c-5gjm-7q23
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Requires high-privilege DB write access (PR:H), no user interaction, and successful deserialization yields full RCE in the application JVM, so C/I/A all High.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions: Spring Security 7.0.0 through 7.0.5.
AnalysisAI
Insecure deserialization in Spring Security 7.0.0 through 7.0.5 allows an attacker with write access to the saml2_asserting_party_metadata database table to store malicious serialized Java payloads in the verification_credentials or encryption_credentials columns, leading to code execution when the JdbcAssertingPartyMetadataRepository deserializes them. The flaw affects deployments using the JDBC-backed SAML 2.0 asserting-party metadata repository introduced in the Spring Security 7.x line. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Spring application (1) runs Spring Security 7.0.0-7.0.5, (2) is configured to use the JdbcAssertingPartyMetadataRepository for SAML 2.0 asserting-party metadata persistence (the default in-memory or file-based repositories are not affected), and (3) the attacker has write capability - directly or via a separate vulnerability such as SQL injection - to the saml2_asserting_party_metadata table's verification_credentials or encryption_credentials columns. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects High privileges required - the attacker must already be able to write rows into the SAML metadata table - but full triad impact once that precondition is met. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who obtains write access to the application database - for instance through a separate SQL injection flaw, leaked DBA credentials, or a malicious insider - crafts a Java serialized gadget chain using libraries already on the Spring Security classpath and writes it into the verification_credentials column of a row in saml2_asserting_party_metadata. When the application next loads asserting-party metadata via JdbcAssertingPartyMetadataRepository (for example, on a SAML login attempt), the payload is deserialized in-process and executes arbitrary code under the application's JVM identity. … |
| Remediation | Upgrade to Spring Security 7.0.6 or later, which is the vendor-released patched version per the Spring advisory at https://spring.io/security/cve-2026-40993 and EUVD-2026-35886. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
24 hours: Inventory all deployments running Spring Security 7.0.0-7.0.5 with JDBC SAML 2.0 repository. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.tran
Cedar policy injection in CedarJava (com.cedarpolicy:cedar-java) versions below 2.3.6, 3.4.1, and 4.9.0 allows attackers
Type confusion in CedarJava versions prior to 2.3.6, 3.4.1, and 4.9 allows authenticated remote attackers to manipulate
Remote code execution in Spinnaker's Orca and Rosco services allows authenticated users to achieve arbitrary Java class
Denial of service in Steeltoe.Discovery.Eureka client (.NET) versions prior to 4.2.0 and 3.4.0 allows a remote Eureka re
Share
External POC / Exploit Code
Leaving vuln.today