CVE-2025-41243
Last modified
CVE-2025-41243 is a critical-severity vulnerability rated 10/10 on the CVSS scale. Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.. EPSS estimates a 3.31% chance of exploitation in the next 30 days.
Description
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * Spring Boot actuator is a dependency. * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-41243?
How severe is CVE-2025-41243?
How do I fix CVE-2025-41243?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-41238VMware ESXi, Workstation, and Fusion contain a heap-overflow…9.3
- CVE-2025-41239VMware ESXi, Workstation, Fusion, and VMware Tools contains …7.1
- CVE-2025-4124Delta Electronics ISPSoft version 3.20 is vulnerable to an O…9.8
- CVE-2025-41240Three Bitnami Helm charts mount Kubernetes Secrets under a p…10
- CVE-2025-41241VMware vCenter contains a denial-of-service vulnerability. A…4.4
- CVE-2025-41242Spring Framework MVC applications can be vulnerable to a “Pa…5.9
- CVE-2025-41244VMware Aria Operations and VMware Tools contain a local priv…7.8
- CVE-2025-41245VMware Aria Operations contains an information disclosure vu…4.9
- CVE-2025-41246VMware Tools for Windows contains an improper authorisation …7.6
- CVE-2025-41248The Spring Security annotation detection mechanism may not c…7.5
- CVE-2025-41249The Spring Framework annotation detection mechanism may not …7.5
- CVE-2025-4125Delta Electronics ISPSoft version 3.20 is vulnerable to an O…9.8
Are you affected by CVE-2025-41243?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST