{"id":"CVE-2026-47825","title":"Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios","summary":"Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.\n\nAffected versions:\nSpring Cloud Gateway …","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","cwe":["CWE-346"],"vendor":"vmware","product":"spring_cloud_gateway","affected":["spring_cloud_gateway <= 3.1.10","spring_cloud_gateway >= 4.0.0, < 4.1.13","spring_cloud_gateway >= 4.2.0, < 4.2.9","spring_cloud_gateway >= 4.3.0, < 4.3.4.1","spring_cloud_gateway >= 5.0.0, < 5.0.1.1"],"patched":["spring_cloud_gateway 5.0.1.1"],"published":"2026-06-15","updated":"2026-10-01","sourceUpdated":"2026-10-01T13:52:27.853","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47825","references":[{"url":"https://spring.io/security/cve-2026-47825","label":"security@vmware.com"}],"tags":["nvd"],"epss":0.00186,"epssPercentile":0.07339,"ingestedAt":"2026-10-01T14:46:26.690Z","slug":"CVE-2026-47825","body":"## Overview\n\nSpring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.\n\nAffected versions:\nSpring Cloud Gateway 3.1.x (fix 3.1.13).\nSpring Cloud Gateway 4.1.x (fix 4.1.13).\nSpring Cloud Gateway 4.2.x (fix 4.2.9).\nSpring Cloud Gateway 4.3.x (fix 4.3.5).\nSpring Cloud Gateway 5.0.x (fix 5.0.2).\n\n## Affected\n\n- `spring_cloud_gateway <= 3.1.10`\n- `spring_cloud_gateway >= 4.0.0, < 4.1.13`\n- `spring_cloud_gateway >= 4.2.0, < 4.2.9`\n- `spring_cloud_gateway >= 4.3.0, < 4.3.4.1`\n- `spring_cloud_gateway >= 5.0.0, < 5.0.1.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `spring_cloud_gateway 5.0.1.1`","depth":"twilight","depthScore":47,"depthScoreParts":{"impact":47.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}