CVE-2026-47825
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.
Risk Assessment
Forwarding these headers from untrusted sources may lead to false user identification and potential spoofing attacks.
Recommendation
It is recommended to upgrade to the fixed versions: 3.1.13, 4.1.13, 4.2.9, 4.3.5, or 5.0.2.
Other vulnerabilities in Spring Cloud Gateway
See all- CVE-2022-22947CriticalActively exploited
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
- CVE-2026-47879High
Spring Cloud Gateway versions 5.0.0-5.0.2, 4.3.0-4.3.5, 4.0.0-4.2.9, and 3.1.13 and earlier are vulnerable in JsonToGrpcGatewayFilterFactory, allowing arbitrary Spring Resource locations for defining the proto descriptor.
Original NVD description (English source)
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS