CVE-2026-47825
Last modified
CVE-2026-47825 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Cloud Gateway | <= 3.1.10 |
| Vmware | Spring Cloud Gateway | >= 4.0.0, < 4.1.13 |
| Vmware | Spring Cloud Gateway | >= 4.2.0, < 4.2.9 |
| Vmware | Spring Cloud Gateway | >= 4.3.0, < 4.3.4.1 |
| Vmware | Spring Cloud Gateway | >= 5.0.0, < 5.0.1.1 |
References
- https://spring.io/security/cve-2026-47825Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-47825?
How severe is CVE-2026-47825?
How do I fix CVE-2026-47825?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-47786An OS command injection vulnerability has been reported to a…9.3
- CVE-2026-4779A security vulnerability has been detected in SourceCodester…8.8
- CVE-2026-47790A cross-site scripting (XSS) vulnerability has been reported…6.3
- CVE-2026-4780A vulnerability was detected in SourceCodester Sales and Inv…8.8
- CVE-2026-4781A flaw has been found in SourceCodester Sales and Inventory …8.8
- CVE-2026-4782The Avada Builder plugin for WordPress is vulnerable to Arbi…6.5
- CVE-2026-47826The blobs.yml path key traversal vulnerability in the BOSH C…9.1
- CVE-2026-47827Command Injection in BOSH CLI tool on windows in Cloud Found…7.5
- CVE-2026-47828During bosh create-env and bosh delete-env, the CLI uploads …8.8
- CVE-2026-47829Argument Injection in bosh-cli allows a compromised BOSH Dir…7.8
- CVE-2026-4783A vulnerability has been found in itsourcecode College Manag…6.3
- CVE-2026-47830Incorrect Permission Assignment in BOSH.Utils.psm1 in BOSH-E…8.5
Are you affected by CVE-2026-47825?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST