Executive Summary

CVE-2026-40993 is a medium-severity vulnerability in Spring Security versions 7.0.0 to 7.0.5. It occurs because the JdbcAssertingPartyMetadataRepository component performs unfiltered Java native deserialization of SAML 2.0 asserting party credentials stored in a database.

An attacker who has write permissions to the database table named saml2_asserting_party_metadata can inject malicious serialized payloads into the verification_credentials or encryption_credentials columns. When the server reads and deserializes these payloads, it may execute arbitrary code.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution on the affected system if an attacker has write access to the relevant database table.

Such an attack could compromise the integrity and availability of the system by allowing the attacker to run arbitrary code with the privileges of the application.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the TRACE logs of the affected Spring Security application for error messages related to deserialization failures.

Specifically, look for log entries starting with "Failed to deserialize due to ..." which indicate issues during the deserialization process of credentials stored in the saml2_asserting_party_metadata table.

No direct network commands are provided, but inspecting application logs at TRACE level is recommended.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Spring Security to version 7.0.6 or later, where this vulnerability is fixed.

If upgrading is not immediately possible and deserialization failures occur, check TRACE logs for deserialization errors and consider adjusting the deserialization process using the method AssertingPartyMetadataRowMapper#setCredentialsDeserializer.

Useful 0 Not Useful 0