CVE-2026-40968 in Spring gRPC
Summary
by MITRE • 04/28/2026
When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions.
Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/12/2026
This vulnerability represents a critical authentication bypass flaw in the Spring gRPC framework that exploits thread-level credential inheritance mechanisms. The issue occurs when an authenticated user attempts to access a gRPC method they are not authorized to use, resulting in access denial. However, the system fails to properly clear the authenticated identity from the worker thread context, allowing this credential information to persist and potentially be inherited by subsequent requests processed on the same thread. This thread-level credential leakage creates a pathway for privilege escalation where an unauthenticated user could inadvertently inherit the privileges of the previously authenticated user who encountered an access denial.
The technical root cause of this vulnerability lies in the improper management of thread-local storage and authentication context within the gRPC worker thread execution model. When authentication fails for a gRPC method, the framework should explicitly clear any authenticated principal or security context from the current thread before allowing the thread to process subsequent requests. Instead, the authentication state remains in memory, creating a security boundary violation where the thread's security context is not properly reset between different request processing cycles. This behavior directly violates fundamental security principles regarding context isolation and proper resource cleanup.
The operational impact of this vulnerability is significant as it enables attackers to potentially escalate their privileges through a simple exploitation pattern. An attacker who successfully authenticates to the system and then attempts to access a restricted gRPC method will trigger the vulnerability. If the access is denied, the authenticated context remains in the thread, and any subsequent request processed by that same thread could inherit those credentials, even if the new request is unauthenticated. This creates a window where unauthorized access to protected resources becomes possible, effectively bypassing the authentication and authorization controls that should normally prevent such access.
The vulnerability manifests as a thread-level credential leakage that can be categorized under CWE-285: Improper Authorization and CWE-306: Missing Authentication for Critical Function. From an attack perspective, this aligns with ATT&CK technique T1078.004: Valid Accounts, where attackers can leverage existing authenticated sessions to gain elevated privileges. The flaw particularly affects systems implementing gRPC services with Spring Framework integration, where thread reuse patterns are common in high-performance service architectures. Organizations using Spring gRPC versions between 1.0.0 and 1.0.2 are at risk, with the vulnerability being addressed through the release of version 1.0.3 which implements proper thread context cleanup mechanisms.
Mitigation strategies should focus on ensuring proper authentication context cleanup in thread-local storage mechanisms and implementing robust thread isolation patterns for security-sensitive operations. The recommended approach involves upgrading to Spring gRPC version 1.0.3 or later where the fix properly clears authentication contexts from worker threads after access denials. Additionally, organizations should consider implementing explicit thread context management policies that ensure security principals are not inherited across different request processing cycles, particularly in environments where thread reuse is prevalent. System administrators should also monitor for potential credential leakage patterns in their gRPC service implementations and implement logging controls to detect anomalous authentication behavior that might indicate exploitation attempts.