Spring gRPC SecurityContext Leak Vulnerability Allowing Escalated Permissions

A vulnerability exists in Spring gRPC versions 1.0.0 to 1.0.2, as well as older unsupported versions. When an authenticated user is denied access to a gRPC method, their identity remains tied to the gRPC worker thread. This identity can be passed to a subsequent unauthenticated request on the same thread, potentially allowing the latter user to gain elevated permissions.

Impact

Exploitation of this vulnerability could lead to unauthorized access and escalated permissions for users on the affected gRPC worker thread.

Remediation

Users should upgrade to Spring gRPC version 1.0.3.