Spring Framework CVE-2026-47892

Exploitation requires a very specific stack: a Spring WebFlux application using functional endpoints (RouterFunction DSL) AND deployed with DispatcherServlet (the servlet bridge, not a native reactive runtime) AND using header predicates to route or restrict access. The trigger is a CORS pre-flight (OPTIONS) request that bypasses the header predicate. Limiting factors that reduce real-world risk: the bypass only matters where a header predicate is being used as a de facto access-control gate; applications on native reactive servers, applications not using functional endpoints, or applications enforcing authorization through Spring Security rather than header predicates are not meaningfully exposed. Per the CVSS vector no authentication or user interaction is needed to reach the affected route.

The signals conflict sharply and should be weighed carefully. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) implies full unauthenticated remote compromise, but the described impact - a header predicate bypass on a pre-flight request in a specific deployment mode - is an authorization/routing-gate bypass, not arbitrary code execution or full data compromise; the C:H/I:H/A:H rating appears inflated relative to the described mechanism and should be verified against the Spring advisory. Supporting this, EPSS is very low (0.19%, 9th percentile), the CVE is not on CISA KEV, and no POC is referenced, so there is no evidence of widespread or automatable exploitation. The realistic priority is driven by exposure: it only bites applications that use WebFlux functional endpoints, deploy on DispatcherServlet, AND rely on header predicates as a security boundary - a narrow intersection. Teams meeting all three conditions should patch promptly because the bypass is remote and pre-authentication for the gated route, while teams not using header-predicate-based gating face little practical risk despite the 9.8 headline. Any operator running an affected build in that exact configuration should treat it as a real access-control gap and remediate on a normal-to-expedited schedule rather than an emergency, given the absence of exploitation signals.

An attacker who knows an application routes or gates a sensitive functional endpoint on a header predicate crafts a CORS pre-flight OPTIONS request that omits or manipulates the required header, causing the predicate gate to be bypassed and the request to reach the otherwise-restricted route. Because the CVSS vector is network, low-complexity, and no-authentication, this can be attempted remotely without credentials, though success requires the target to actually depend on the vulnerable header-predicate configuration. No public exploit code is currently identified.