What is the CVSS score of CVE-2026-41847?

CVE-2026-41847 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-41847?

Yes, a patch is available for CVE-2026-41847. Update the affected software to the latest version immediately.

Spring Framework CVE-2026-41847

EUVD-2026-35335 MEDIUM

Improper Access Control (CWE-284)

2026-06-09 vmware

GHSA-vqgp-pf68-6947

Authentication Bypass Java Spring Framework

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 11, 2026 - 16:22 NVD

4.8 (MEDIUM) 5.3 (MEDIUM)

Patch available

Jun 09, 2026 - 06:01 EUVD

Analysis Generated

Jun 09, 2026 - 05:23 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

58 maven packages depend on org.springframework:spring-webflux (13 direct, 45 indirect)

Ecosystem-wide dependent count for version 5.3.39.

DescriptionNVD

Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL.

Affected versions: Spring Framework 5.3.0 through 5.3.48.

AnalysisAI

Security bypass in Spring WebFlux's Kotlin Router DSL (CWE-284: Improper Access Control) allows remote unauthenticated attackers to circumvent access control rules in Spring Framework 5.3.0 through 5.3.48. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates network-reachable exploitation without authentication, though high attack complexity constrains opportunistic exploitation. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Spring WebFlux is the reactive, non-blocking web framework shipped as part of Spring Framework (cpe:2.3:a:spring:spring_framework:*:*:*:*:*:*:*:*), built on Project Reactor and designed for high-concurrency workloads. The Kotlin Router DSL is a Kotlin-idiomatic alternative to the annotation-based or Java-style functional RouterFunction API, allowing developers to define HTTP route handlers in a declarative, DSL-style syntax. CWE-284 (Improper Access Control) as the root cause suggests the DSL's route-matching or filter-chaining logic fails to correctly propagate or enforce security constraints - likely that Spring Security filters, access predicates, or route-level authorization rules defined outside the Kotlin DSL are partially or fully bypassed when routing is defined via this DSL. This is a class of vulnerability where framework-layer abstractions diverge in security contract enforcement from the underlying servlet or reactive filter chain.

RemediationAI

Patch available per vendor advisory at https://spring.io/security/cve-2026-41847; however, an exact patched release version was not present in the available data and cannot be confirmed independently - consult the Spring security advisory directly to identify the target upgrade version within or above the 5.3.x line. As a compensating control while awaiting an upgrade, teams should audit all routes defined via the Kotlin Router DSL to verify that Spring Security filter chain rules are not being silently bypassed - specifically, test whether access restrictions defined at the HttpSecurity level are enforced for every Kotlin DSL-defined route. If route-level security cannot be confirmed, consider temporarily migrating critical protected routes to annotation-based controllers or Java-style functional endpoints where security filter propagation is well-tested. This mitigation trades DSL ergonomics for a verified security contract and may require refactoring effort proportional to routing complexity.