CVE-2026-40993: Spring Security Privilege Escalation

CVE-2026-40993 Overview

CVE-2026-40993 is an insecure deserialization vulnerability [CWE-502] in Spring Security's JdbcAssertingPartyMetadataRepository. An attacker with write permissions to the saml2_asserting_party_metadata database table can store malicious serialized payloads in the verification_credentials and encryption_credentials columns. When Spring Security reads these columns, it deserializes the attacker-controlled bytes, enabling arbitrary object instantiation. The flaw affects Spring Security versions 7.0.0 through 7.0.5.

Critical Impact
A database-privileged attacker can achieve code execution or service compromise within applications using SAML 2.0 asserting party metadata stored through the JDBC repository.

Affected Products

Spring Security 7.0.0
Spring Security 7.0.1 through 7.0.4
Spring Security 7.0.5

Discovery Timeline

2026-06-10 - CVE-2026-40993 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-40993

Vulnerability Analysis

The JdbcAssertingPartyMetadataRepository class persists SAML 2.0 asserting party metadata in a relational database. Two columns, verification_credentials and encryption_credentials, store collections of Saml2X509Credential objects as serialized Java byte streams. On read operations, Spring Security deserializes these bytes back into Java objects.

Java deserialization processes class data without restricting the object graph. An attacker who controls the bytes stored in these columns can craft gadget chains that execute code during deserialization. This places the vulnerability in the Insecure Deserialization category.

Exploitation requires write access to the underlying database table. The attack vector is adjacent network because the attacker must already hold high privileges on the database backing the application.

Root Cause

The root cause is the use of native Java serialization for credential collections without integrity protection or class allow-listing. Spring Security trusts the contents of the verification_credentials and encryption_credentials columns as if they were internally generated, but the JDBC layer cannot guarantee their origin.

Attack Vector

An attacker with INSERT or UPDATE privileges on the saml2_asserting_party_metadata table writes a serialized gadget chain into the credentials columns. When the Spring Security application loads the metadata for SAML processing, the deserialization routine instantiates the attacker's object graph. Refer to the Spring Security Advisory CVE-2026-40993 for vendor technical details.

Detection Methods for CVE-2026-40993

Indicators of Compromise

Unexpected UPDATE or INSERT statements targeting the saml2_asserting_party_metadata table from accounts that do not normally manage SAML metadata.
Java process child executions, outbound network connections, or file writes originating from the Spring Security application during SAML metadata load operations.
Java deserialization stack traces involving Saml2X509Credential collections in application logs.

Detection Strategies

Audit database query logs for write activity on verification_credentials and encryption_credentials columns and correlate with the authorized change management workflow.
Compare stored credential byte streams against a known-good baseline and flag entries that contain class signatures outside the expected Saml2X509Credential set.
Enable Java Flight Recorder or equivalent runtime instrumentation to capture ObjectInputStream.readObject calls within the Spring Security SAML codepath.

Monitoring Recommendations

Forward database audit logs and JVM telemetry to a centralized analytics platform to alert on anomalous behavior around SAML metadata reads.
Monitor for new processes spawned by the application JVM following SAML asserting party metadata refreshes.
Track Spring Security version inventory across services and alert when any instance reports 7.0.0 through 7.0.5.

How to Mitigate CVE-2026-40993

Immediate Actions Required

Upgrade Spring Security to a fixed release as specified in the Spring Security Advisory CVE-2026-40993.
Revoke write privileges on the saml2_asserting_party_metadata table from any account that does not require them.
Review existing rows in verification_credentials and encryption_credentials and restore them from a trusted source.

Patch Information

VMware/Spring released fixed versions of Spring Security beyond 7.0.5. Application owners must update the spring-security-saml2-service-provider dependency and redeploy. Consult the vendor advisory for the exact fixed version and any related supporting library updates.

Workarounds

Restrict database access so only the application service account can write to saml2_asserting_party_metadata, and enforce least privilege on that account.
Replace JdbcAssertingPartyMetadataRepository with a custom AssertingPartyMetadataRepository implementation that does not rely on Java serialization for credential storage.
Apply database row integrity checks, such as HMAC signatures over credential blobs, validated by the application before deserialization.

bash

# Configuration example
# Restrict write access to the SAML metadata table at the database level
REVOKE INSERT, UPDATE, DELETE ON saml2_asserting_party_metadata FROM PUBLIC;
GRANT SELECT ON saml2_asserting_party_metadata TO app_runtime_user;
GRANT INSERT, UPDATE, DELETE ON saml2_asserting_party_metadata TO saml_admin_user;