CVE-2026-40968: Spring Grpc: güvenlik açığı

Açıklama (NVD)

When an authenticated user is denied access to a gRPC method, their authenticated identity remains bound to the gRPC worker thread and can be inherited by a subsequent unauthenticated request on the same thread. This may allow the subsequent user to gain escalated permissions. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.

Özet bilgiler

Ürün

Vmware Spring Grpc

CVSS v3.1

8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

%0,17 (yüzdelik 7)

CWE

CWE-653

Yama

Yok / bilinmiyor

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• spring.io
• CWE-653