CVE-2026-47879

Overview

Spring Cloud Gateway is the API gateway project built on Spring Boot and Project Reactor. It sits in front of backend services and routes incoming requests through a configurable chain of predicates and gateway filters, providing concerns such as path rewriting, rate limiting, circuit breaking, and protocol translation at the edge of a system.

A Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-47879) has been identified in the JSON to gRPC gateway filter of Spring Cloud Gateway, which allows attackers who can supply or influence a route definition to point the gRPC proto descriptor at an arbitrary Spring Resource location, including file system paths and remote URLs, causing the gateway to read local files or issue requests to internal network endpoints on their behalf.

Per OWASP: The target application may have functionality for importing data from a URL, publishing data to a URL or otherwise reading data from a URL that can be tampered with. The attacker modifies the calls to this functionality by supplying a completely different URL or by manipulating how URLs are built (path traversal etc.). When the manipulated request goes to the server, the server-side code picks up the manipulated URL and tries to read data to the manipulated URL.

This issue affects the JSON to gRPC gateway filter of Spring Cloud Gateway.

Details

Module Info

• Product: Spring Cloud Gateway
• Affected packages: org.springframework.cloud:spring-cloud-gateway-server, org.springframework.cloud:spring-cloud-gateway-server-webflux
• Affected versions:
• org.springframework.cloud:spring-cloud-gateway-server: >=3.1.4 <=3.1.13, >=4.0.0 <=4.2.9, >=4.3.0 <=4.3.5
• org.springframework.cloud:spring-cloud-gateway-server-webflux: >=5.0.0 <=5.0.2
• GitHub repository: https://github.com/spring-cloud/spring-cloud-gateway
• Published packages: https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-gateway-server, https://central.sonatype.com/artifact/org.springframework.cloud/spring-cloud-gateway-server-webflux
• Package manager: Maven
• Fixed in:
• NES for Spring Cloud Gateway v3.1.17, v4.1.13, v4.2.10 and v4.3.7
• OSS Spring Cloud Gateway 5.0.3

Vulnerability Info

This High-severity vulnerability is found in the org.springframework.cloud:spring-cloud-gateway-server and org.springframework.cloud:spring-cloud-gateway-server-webflux packages in the JSON to gRPC gateway filter of Spring Cloud Gateway.

The JsonToGrpc filter translates an inbound JSON request into a gRPC call. It needs a compiled protobuf descriptor to do so, and the location of that descriptor is taken straight from the route configuration through the protoDescriptor shortcut field:

public class JsonToGrpcGatewayFilterFactory
        extends AbstractGatewayFilterFactory<JsonToGrpcGatewayFilterFactory.Config> {

    private final GrpcSslConfigurer grpcSslConfigurer;

    private final ResourceLoader resourceLoader;

    public JsonToGrpcGatewayFilterFactory(GrpcSslConfigurer grpcSslConfigurer, ResourceLoader resourceLoader) {
        super(Config.class);
        this.grpcSslConfigurer = grpcSslConfigurer;
        this.resourceLoader = resourceLoader;
    }

    @Override
    public List<String> shortcutFieldOrder() {
        return Arrays.asList("protoDescriptor", "protoFile", "service", "method");
    }

When the filter builds its response decorator, the configured value is handed to a Spring ResourceLoader with no validation of the resource location at all:

GRPCResponseDecorator(ServerWebExchange exchange, Config config) {
    super(exchange.getResponse());
    this.exchange = exchange;
    try {
        Resource descriptorFile = resourceLoader.getResource(config.getProtoDescriptor());
        Resource protoFile = resourceLoader.getResource(config.getProtoFile());

        descriptor = DescriptorProtos.FileDescriptorProto.parseFrom(descriptorFile.getInputStream())
            .getDescriptorForType();

ResourceLoader.getResource resolves whatever prefix it is given. A plain path or a file: location reads from the gateway host's file system, a file: location containing ../ segments escapes the directory the deployment intended to expose, and an http: or https: location makes the gateway itself fetch the descriptor over the network. Because the descriptor string is never checked against an allowed set of locations, any actor able to write or influence a route definition, whether through a dynamic route repository, an externalized configuration source, or a management endpoint that accepts route definitions, turns the gateway into a fetcher for resources it should never expose. Reachable targets include configuration and credential files on the gateway host and internal HTTP services that are not routable from outside the network perimeter, which is why the issue carries a changed scope in its CVSS vector.

The remediated code introduces an allow list of valid prefixes, defaulting to classpath locations only, normalises the requested resource, and rejects any protoDescriptor or protoFile that does not resolve inside an allowed prefix. On the 3.1.x through 4.3.x lines protoFile is a second route-supplied resource location, and a single property governs the allowed locations for both fields.

Mitigation

Only recent versions of Spring Cloud Gateway receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring Cloud Gateway.
• Where the JSON to gRPC filter is in use, treat route definitions as privileged configuration that untrusted users cannot supply, and on a build that carries the fix restrict proto descriptors to trusted locations by setting the valid proto descriptor prefixes property for your line, spring.cloud.gateway.server.webflux.json-to-grpc.valid-proto-descriptor-prefixes on 5.0.x and 4.3.x or spring.cloud.gateway.json-to-grpc.valid-proto-descriptor-prefixes on 4.2.x, 4.1.x, and 3.1.x.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• @thesecguy45 (finder)