Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks. Affected versions: Spring gRPC: 1.0.0 - 1.0.2 (fixed in 1.0.3). Older, unsupported versions are also affected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-40969 The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker … https://www.cve.org/CVERecord?id=CVE-2026-40969
Post summary
The post announces CVE‑2026‑40969, describing an information disclosure via returned AuthenticationException messages, without referencing any PoC, exploit, or patch.
CVE-2026-40969 Information Disclosure via AuthenticationException in Spring gRPC 1.0.0-1.0.2 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40969
Post summary
The post announces CVE-2026-40969, an information‑disclosure vulnerability in Spring gRPC versions 1.0.0–1.0.2 caused by an AuthenticationException. No PoC, exploit, or mitigation is provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vmware | spring_grpc | - | - | - |