CVE-2026-40993: Spring Security SAML Metadata Deserialization RCE

Technical summary

CVE-2026-40993 exploits unsafe deserialization in JdbcAssertingPartyMetadataRepository, which persists SAML asserting party metadata to a relational database table (saml2_asserting_party_metadata). The vulnerability exists in the verification_credentials and encryption_credentials columns, which store serialized Java objects representing cryptographic keys and certificates. An attacker with INSERT or UPDATE permissions on this table can craft malicious serialized payloads that, upon deserialization by the application, execute arbitrary code. The issue stems from CWE-502 (Deserialization of Untrusted Data) and requires a sophisticated attacker with database access, but the consequences justify the HIGH severity rating.

Business impact

Compromise of a Spring Security-protected application's metadata layer can undermine the entire SAML authentication chain. An attacker exploiting this could impersonate legitimate SAML identity providers, intercept or forge authentication tokens, or escalate privileges within federated systems. In enterprise environments relying on Spring Security for SSO or multi-tenant SAML workflows, this creates a path to authentication bypass and lateral movement across dependent applications. The threat is heightened in scenarios where database access controls are weak or where insider threats exist.

Affected systems

Spring Security 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, and 7.0.5 are in scope. Any Spring Boot or Spring application configured to use JdbcAssertingPartyMetadataRepository for SAML 2.0 service provider operations is at risk. Organizations running Spring Security 6.x or earlier versions are unaffected. The vulnerability is specific to the JDBC-backed metadata repository and does not affect in-memory or XML-based metadata configurations.

Exploitability

Exploitation requires database write privileges, which significantly constrains the threat model. An attacker must either compromise database credentials, exploit a separate SQL injection vulnerability, or leverage insider access. Once that foothold exists, crafting a malicious serialized payload is straightforward for an advanced attacker familiar with Java deserialization gadget chains. The attack is not exploitable over the network without prior database compromise. The CVSS vector (AV:A/AC:H/PR:H) reflects these prerequisites; however, the HIGH severity underscores that database compromise is a plausible scenario in shared hosting or cloud environments. This vulnerability is not presently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade to Spring Security 7.0.6 or later, which contains a fix for unsafe deserialization in credential storage. If immediate patching is not feasible, restrict database write permissions to the saml2_asserting_party_metadata table to only trusted administrative accounts and service accounts. Audit recent database modification logs for unauthorized changes to metadata columns. In high-risk environments, rotate SAML signing and encryption credentials and monitor for anomalous authentication events or token issuance patterns.

Patch guidance

Spring Security patch releases addressing this issue are expected in the 7.0.x branch. Verify the exact patched version against the VMware Spring Security advisory and release notes before deployment. Organizations should test the patch in a staging environment to ensure compatibility with existing SAML configurations and metadata caching layers. No breaking changes are anticipated, but validation of metadata reload behavior is recommended post-upgrade.

Detection guidance

Monitor database audit logs for INSERT or UPDATE operations on the saml2_asserting_party_metadata table, particularly modifications to verification_credentials or encryption_credentials columns. Establish baseline profiles of normal metadata updates and alert on deviations. Review application logs for deserialization errors or unexpected exception stack traces mentioning java.io.ObjectInputStream or gadget chain classes. In SIEM platforms, correlate database modification events with subsequent authentication anomalies—unexpected principal elevation, unusual token claims, or failed SAML assertion validations—to detect post-exploitation activity.

Why prioritize this

Despite the HIGH CVSS score, real-world urgency depends on organizational context. Teams deploying Spring Security 7.0.x specifically for SAML functionality should prioritize patching within 2-4 weeks. Organizations with Spring Security 6.x or non-SAML deployments can defer. This vulnerability has not achieved public exploitation maturity, but the combination of authentication layer criticality and the relative ease of crafting payloads post-compromise warrants proactive remediation before adversaries mature proof-of-concept code.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects the severity of code execution via deserialization, the scope expansion to other systems through SAML federation, and the integrity and availability impacts. However, the score is moderated by the required database write access (PR:H) and the high complexity of exploitation (AC:H), which assume attacker sophistication. Organizations with robust database access controls and network segmentation may treat this as a medium priority, while those with weak database hygiene should treat it as critical.

Frequently asked questions