When an authenticated user is denied access to a gRPC method, the user’s credential remains bound to the worker thread handling the request. If a later request is processed on the same thread without authenticating, the original identity can be inherited, potentially giving the new caller elevated privileges. This flaw is a practical example of a context‑leak exploitation that can elevate an attacker’s authority within the same application.

The Spring gRPC library version 1.0.0 through 1.0.2 is affected. The vulnerability was fixed in 1.0.3, and older unsupported releases are also vulnerable.

The CVSS score of 4.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog, so there are no publicly known exploits at this time. The compromise depends on a request sequence that occurs on the same worker thread; thus, an attacker would need to influence thread usage or trigger a chain of requests within the same service. While the threat is generally internal, the ability to inherit an authenticated context motivates timely remediation.