CVE-2026-47879
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Spring Cloud Gateway versions 5.0.0-5.0.2, 4.3.0-4.3.5, 4.0.0-4.2.9, and 3.1.13 and earlier are vulnerable in JsonToGrpcGatewayFilterFactory, allowing arbitrary Spring Resource locations for defining the proto descriptor.
Risk Assessment
An attacker could exploit this to read sensitive files or resources in the application context, potentially leading to information disclosure or further attacks.
Recommendation
Upgrade Spring Cloud Gateway to a version that fixes this vulnerability.
Other vulnerabilities in Spring Cloud Gateway
See all- CVE-2022-22947CriticalActively exploited
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
- CVE-2026-47825High
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.
Original NVD description (English source)
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier
Vulnerability data from NVD (NIST) · CISA KEV · EPSS