CVE-2025-41253
Last modified
CVE-2025-41253 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes. * An untrusted third party could create a route that uses SpEL to access environment variables or system properties if: * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.. EPSS estimates a 0.43% chance of exploitation in the next 30 days.
Description
The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to the ability to expose environment variables and system properties to attackers. An application should be considered vulnerable when all the following are true: * The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable). * An admin or untrusted third party using Spring Expression Language (SpEL) to access environment variables or system properties via routes. * An untrusted third party could create a route that uses SpEL to access environment variables or system properties if: * The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway and management.endpoint.gateway.enabled=trueor management.endpoint.gateway.access=unrestricte. * The actuator endpoints are available to attackers. * The actuator endpoints are unsecured.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-41253?
How severe is CVE-2025-41253?
How do I fix CVE-2025-41253?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-41248The Spring Security annotation detection mechanism may not c…7.5
- CVE-2025-41249The Spring Framework annotation detection mechanism may not …7.5
- CVE-2025-4125Delta Electronics ISPSoft version 3.20 is vulnerable to an O…9.8
- CVE-2025-41250VMware vCenter contains an SMTP header injection vulnerabili…8.5
- CVE-2025-41251VMware NSX contains a weak password recovery mechanism vulne…8.1
- CVE-2025-41252Description: VMware NSX contains a username enumeration vuln…7.5
- CVE-2025-41254STOMP over WebSocket applications may be vulnerable to a sec…4.3
- CVE-2025-41255Cyberduck and Mountain Duck improperly handle TLS certificat…8
- CVE-2025-41256Cyberduck and Mountain Duck improper handle TLS certificate …7.4
- CVE-2025-41257Suprema’s BioStar 2 in version 2.9.11.6 allows users to set …4.8
- CVE-2025-41258LibreChat version 0.8.1-rc2 uses the same JWT secret for the…8
- CVE-2025-41259SWUpdate before 2026.05 is affected by a time-of-check time-…7.3
Are you affected by CVE-2025-41253?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST