Vulnerability · Published Jun 15, 2026 · Assigned by vmware

CVE-2026-47825Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

High 8.6

In plain English

A high-severity security flaw in Spring Cloud Gateway from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.2%top 92.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

Affected products (as reported)

Vendor	Product	Versions
Spring	Spring Cloud Gateway	3.1.0 – before 3.1.134.1.0 – before 4.1.134.2.0 – before 4.2.94.3.0 – before 4.3.4.15.0.0 – before 5.0.1.1

Weakness: CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

References

https://spring.io/security/cve-2026-47825