Spring Cloud Gateway CVE-2025-41253

Exploitation by an untrusted third party requires all of: (1) the application uses Spring Cloud Gateway Server Webflux (WebMVC is NOT vulnerable); (2) the gateway actuator web endpoint is explicitly enabled via management.endpoints.web.exposure.include=gateway together with management.endpoint.gateway.enabled=true (or management.endpoint.gateway.access=unrestricted); (3) that actuator endpoint is network-reachable by the attacker; and (4) it is unsecured (no authentication/authorization). The attacker then uses SpEL in a route to read environment variables or system properties. Limiting factors: these actuator settings are non-default, so a hardened deployment that keeps the gateway actuator disabled or secured is not exploitable by untrusted parties; in the admin-only scenario, SpEL access to env/properties is a legitimate operator capability rather than an attack path.

This is a moderate-priority information-disclosure flaw whose real-world risk hinges almost entirely on configuration rather than raw CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 HIGH) describes a remote, unauthenticated, confidentiality-only impact, but the description makes clear that exploitation by an untrusted third party requires a specific non-default and insecure deployment: the Spring Cloud Gateway actuator endpoint must be enabled (management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=true, or access=unrestricted), reachable by attackers, and left unsecured. In a hardened default deployment the actuator is not exposed, so the PR:N rating reflects the misconfigured state rather than a universally reachable condition - this is the key tension between the headline score and actual risk. Supporting signals point to lower urgency: EPSS is only 0.48% (39th percentile), there is no CISA KEV listing, and no public exploit code is referenced in the provided data. Impact is limited to disclosure of environment variables and system properties (C:H, I:N, A:N) - serious because those often contain secrets/credentials, but not code execution. Net: treat as a configuration-hygiene priority (audit exposed/unsecured actuator endpoints and SpEL route usage) rather than an emergency patch-now item, while noting that leaked secrets could enable follow-on attacks.

An organization exposes the Spring Cloud Gateway Server Webflux actuator gateway endpoint to the network without authentication. A remote attacker creates or manipulates a route definition that uses a Spring Expression Language (SpEL) expression referencing environment variables or system properties, then triggers evaluation and reads back the disclosed values (e.g., credentials or internal configuration). No public exploit code is identified at time of analysis, and low attack complexity applies only once the actuator is confirmed exposed and unsecured.