Vulnerability Directory | CVE-2026-47825

Overview

Spring Cloud Gateway is an API gateway built on the Spring ecosystem that routes requests to downstream services and applies cross-cutting concerns such as security, monitoring, and resiliency. It ships two server flavors, one built on Spring WebFlux and one built on Spring WebMVC, and both append standard proxy headers such as Forwarded and X-Forwarded-For to requests they forward.

A high-severity vulnerability (CVE-2026-47825) has been identified in Spring Cloud Gateway. In certain configuration scenarios, both the WebFlux and WebMVC Gateway Servers forward the X-Forwarded-For and Forwarded headers supplied by untrusted clients to downstream services instead of stripping them. A client that connects to the gateway directly can therefore inject arbitrary values for the apparent client IP address, host, and protocol that downstream services receive.

Per OWASP, broken access control occurs when restrictions on what users are allowed to do are not properly enforced, so that an actor is able to act outside of their intended permissions. Downstream services routinely trust forwarded headers from a gateway for IP-based allowlisting, rate limiting, tenant resolution, audit logging, and link generation, so spoofed values can let an attacker bypass IP-based access controls or poison security-relevant records.

This issue affects versions <=4.3.4 and >=5.0.0 <=5.0.1 of Spring Cloud Gateway. Older, unsupported versions are also affected.

‍

Details

Module Info

Product: Spring Cloud Gateway
Affected packages: spring-cloud-gateway-server, spring-cloud-gateway-server-mvc
Affected versions: <=4.3.4, >=5.0.0 <=5.0.1
GitHub repository: https://github.com/spring-cloud/spring-cloud-gateway
Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-gateway-server
Package manager: Maven
Fixed in:
NES for Spring Cloud Gateway 3.0.x, 3.1.x, 4.1.x, 4.2.x
Spring Cloud Gateway 4.3.4.1, 4.3.5, 5.0.1.1, 5.0.2 (OSS)

Vulnerability Info

Spring Cloud Gateway manages proxy headers through ForwardedHeadersFilter and XForwardedHeadersFilter in the WebFlux server, and through ForwardedRequestHeadersFilter and XForwardedRequestHeadersFilter in the WebMVC server. These filters honor the spring.cloud.gateway.trusted-proxies property, which defines a pattern of proxy addresses whose forwarded headers may be trusted.

The protection had two gaps. First, when trusted-proxies was configured and a request arrived from an address that did not match the pattern, the filters declined to append gateway-generated values but returned the incoming headers unchanged, so the untrusted client's own Forwarded and X-Forwarded-For headers were passed through to the downstream service:

if (trustedProxies != null && request.getRemoteAddress() != null
        && !trustedProxies.isTrusted(request.getRemoteAddress().getHostString())) {
    log.trace(LogMessage.format("Remote address not trusted. pattern %s remote address %s", trustedProxies,
            request.getRemoteAddress()));
    return input;
}

Second, when trusted-proxies was not configured at all, the forwarded-header filters were not registered, so nothing removed the incoming headers and they flowed to the backend untouched.

The remediation removes all Forwarded and X-Forwarded-* headers unless something is explicitly configured to allow them through. Requests from proxies that do not match the trusted-proxies pattern now have those headers stripped rather than passed along, and new removal filters (RemoveForwardedHeadersFilter and RemoveXForwardedHeadersFilter in the WebFlux server, with equivalent filters in the WebMVC server) are enabled automatically whenever the corresponding allow filter is not active. In addition, the WebFlux server's NettyServerCustomizer is now disabled by default and must be explicitly re-enabled with the customizer-enabled property if required.

This vulnerability was introduced in 2018 with Spring Cloud Gateway 2.0.

‍

Mitigation

Spring Cloud Gateway 3.0.x, 3.1.x, 4.1.x, and 4.2.x are End-of-Life in open source and have no publicly available fix for this issue; see https://spring.io/projects/spring-cloud-gateway for the support timeline. HeroDevs does not recommend that users attempt to develop and apply their own source patches to End-of-Life software.

The recommended actions are:

Upgrade to a supported, fixed release. The issue is fixed in OSS in Spring Cloud Gateway 4.3.4.1, 4.3.5, 5.0.1.1, and 5.0.2. After upgrading, set spring.cloud.gateway.trusted-proxies to the addresses of proxies you trust, and only re-enable the Netty server customizer via the customizer-enabled property if your deployment requires it.
For End-of-Life lines that cannot be upgraded, HeroDevs Never-Ending Support (NES) for Spring Cloud Gateway is making this fix available as a drop-in replacement that remains compatible with the affected versions. Learn more about HeroDevs Never-Ending Support for Spring Cloud Gateway and request coverage at https://www.herodevs.com/support/spring-nes

‍