AIKIDO-2026-10682
spring-grpc-core is vulnerable to Information Disclosure
37
Low Risk
This Affects:
spring-grpc-coreTL;DR
Affected versions of Spring gRPC are vulnerable to Information Disclosure. The raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This allows an attacker to obtain information about the authentication failure, which may be useful for further attacks.
Who does this affect?
You are affected if using a vulnerable version.
Background info
spring-grpc-core is vulnerable to Information Disclosure in versions 0.0.1 - 1.0.2.
How to fix this
Upgrade the org.springframework.grpc:spring-grpc-core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant