CVE-2026-40993: Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository

June 10, 2026 (updated August 12, 2026)

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).

Affected versions: Spring Security 7.0.0 through 7.0.5.

References

github.com/advisories/GHSA-2q7c-5gjm-7q23
github.com/spring-projects/spring-security/releases/tag/7.0.6
nvd.nist.gov/vuln/detail/CVE-2026-40993
spring.io/security/cve-2026-40993

Code Behaviors & Features

Detect and mitigate CVE-2026-40993 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →