Actively exploited in the wild
VMware Spring Cloud Gateway Code Injection Vulnerability
VMware - Spring Cloud Gateway · Listed in the CISA KEV since 2022-05-16. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-22947
CriticalCVSS 10.0KEVSummary
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
Risk Assessment
An attacker can remotely execute arbitrary code on the host, leading to full system compromise. The risk is high if the Actuator endpoint is exposed without authentication.
Recommendation
Upgrade Spring Cloud Gateway to version 3.1.1+ or 3.0.7+. Disable or secure the Gateway Actuator endpoint if not needed.
Other vulnerabilities in Spring Cloud Gateway
See all- CVE-2026-47879High
Spring Cloud Gateway versions 5.0.0-5.0.2, 4.3.0-4.3.5, 4.0.0-4.2.9, and 3.1.13 and earlier are vulnerable in JsonToGrpcGatewayFilterFactory, allowing arbitrary Spring Resource locations for defining the proto descriptor.
- CVE-2026-47825High
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.
Original NVD description (English source)
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.