Spring Cloud Gateway vulnerabilities
3 known CVE vulnerabilities in Spring Cloud Gateway, translated and rated.
- CVE-2022-22947CriticalActively exploited
In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+, applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
- CVE-2026-47879High
Spring Cloud Gateway versions 5.0.0-5.0.2, 4.3.0-4.3.5, 4.0.0-4.2.9, and 3.1.13 and earlier are vulnerable in JsonToGrpcGatewayFilterFactory, allowing arbitrary Spring Resource locations for defining the proto descriptor.
- CVE-2026-47825High
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.