28 April 2026 - 12:32
Category: IT Fail
Spring gRPC Leaks Secrets Again
Spring gRPC is blabbing raw authentication errors to the public, because keeping secrets is apparently too much effort for modern code. It’s basically doing the hackers’ job.
Source: spring.io
The Full Story
Developers using Spring gRPC versions 1.0.0 through 1.0.2 are currently providing a masterclass in oversharing by reflecting raw AuthenticationException messages to unauthenticated callers. This helpful little leak provides remote attackers with a detailed map for follow-on strikes, because why bother with security when you can just vent your internal errors to the world? We mitigate this chatty behavior by upgrading to the latest versions released today and praying that the next update doesn't find a new way to spill the beans. It’s just another delightful instance of middleware being its own worst enemy.