What is the CVSS score of CVE-2026-47825?

CVE-2026-47825 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Spring Cloud Gateway are affected by CVE-2026-47825?

Spring Cloud Gateway versions 3.1.x through 5.0.x contain an origin validation flaw enabling attackers to inject X-Forwarded-For and Forwarded headers to spoof client identity, potentially bypassing…. A patch is available.

How to fix or mitigate CVE-2026-47825?

24 hours: Inventory all systems running Spring Cloud Gateway 3.1.x, 4.1.x, 4.2.x, 4.3.x, or 5.0.x; assess exposure to untrusted proxy sources; review gateway logging for header injection attempts. 7 days: Disable automatic forwarding of X-Forwarded-For and Forwarded headers from untrusted proxies; implement strict header validation rules at gateway ingress; deploy WAF rules to block malformed header patterns. 30 days: Establish automated monitoring for vendor patch release; develop and test upgrade procedures for immediate deployment when patch becomes available.

Spring Cloud Gateway CVE-2026-47825

EUVD-2026-37000 HIGH

Origin Validation Error (CWE-346)

2026-06-15 vmware

GHSA-hf28-w9wf-5x8m

Java Information Disclosure Spring Cloud Gateway

8.6

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

vuln.today AI

6.8 MEDIUM

Network-reachable and unauthenticated, but vendor scopes it to 'certain configuration scenarios' and impact requires a trusting downstream, so AC:H; scope changes to downstream services with integrity-only impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:H/SA:N

Red Hat

7.5 MEDIUM

qualitative

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 15, 2026 - 22:32 EUVD

Analysis Generated

Jun 15, 2026 - 21:53 vuln.today

CVE Published

Jun 15, 2026 - 19:34 cve.org

HIGH 8.6

DescriptionCVE.org

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.

Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).

Articles & Coverage 2

News 3 New Java Vulnerabilities - 3 High Severity Jun 16, 2026 News 3 New Java Vulnerabilities - 3 High Severity, No Public Exploits Jun 15, 2026

AnalysisAI

Origin validation failure in Spring Cloud Gateway (WebMVC and WebFlux Server variants) allows remote attackers to spoof client identity by injecting X-Forwarded-For and Forwarded headers that the gateway then forwards from untrusted proxies in certain configuration scenarios. The flaw, tracked as CVE-2026-47825 with a CVSS 3.1 base score of 8.6 (Scope:Changed, Integrity:High), affects Spring Cloud Gateway 3.1.x, 4.1.x, 4.2.x, 4.3.x, and 5.0.x. No public exploit identified at time of analysis, but the trust-boundary nature of the issue makes it an attractive target for downstream authentication and access-control bypass.

Technical ContextAI

Spring Cloud Gateway is the VMware/Broadcom Spring-based API gateway built on either the reactive WebFlux stack or the servlet WebMVC stack, commonly deployed as the north-south ingress for Spring Boot microservices. CWE-346 (Origin Validation Error) captures the root cause: the gateway accepts and relays the X-Forwarded-For and Forwarded headers it receives from an upstream proxy without verifying whether that proxy is trusted. Both headers are RFC 7239 / de-facto standards that downstream services typically consume to derive the original client IP for logging, rate limiting, IP allow-lists, and audit. Because Spring Cloud Gateway sits at the trust boundary, any failure to strip or validate these headers means a remote attacker's claim about the client IP can flow unchecked into application logic. The CPE cpe:2.3:a:spring:spring_cloud_gateway:*:*:*:*:*:*:*:* covers all maintained branches identified in the advisory.

RemediationAI

Upgrade to the patched release on your current branch: Spring Cloud Gateway 3.1.13, 4.1.13, 4.2.9, 4.3.5, or 5.0.2, per the vendor advisory at https://spring.io/security/cve-2026-47825. If patching cannot be done immediately, place the gateway behind a trusted reverse proxy or load balancer that strips inbound X-Forwarded-For and Forwarded headers before they reach Spring Cloud Gateway, then re-injects them under controlled values - the trade-off is that any application logic relying on client-supplied forwarding headers must be re-validated. Alternatively, configure the gateway and downstream services to derive client IP from the immediate connection rather than from these headers, accepting the loss of accurate client-IP attribution when a legitimate proxy chain exists. Audit downstream services that consume X-Forwarded-For or Forwarded for authentication, IP allow-listing, or audit logging, because those are the components that will absorb the integrity impact even after the gateway is patched.