---
id: CVE-2026-47825
title: >-
  Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers
  from untrusted proxies in certain configuration scenarios
summary: >-
  Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers
  from untrusted proxies in certain configuration scenarios. This affects both
  the WebMVC and WebFlux Gateway Servers.


  Affected versions:

  Spring Cloud Gateway …
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N'
cwe:
  - CWE-346
vendor: vmware
product: spring_cloud_gateway
affected:
  - spring_cloud_gateway <= 3.1.10
  - 'spring_cloud_gateway >= 4.0.0, < 4.1.13'
  - 'spring_cloud_gateway >= 4.2.0, < 4.2.9'
  - 'spring_cloud_gateway >= 4.3.0, < 4.3.4.1'
  - 'spring_cloud_gateway >= 5.0.0, < 5.0.1.1'
patched:
  - spring_cloud_gateway 5.0.1.1
published: '2026-06-15'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T13:52:27.853'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47825'
references:
  - url: 'https://spring.io/security/cve-2026-47825'
    label: security@vmware.com
tags:
  - nvd
epss: 0.00186
epssPercentile: 0.07339
ingestedAt: '2026-10-01T14:46:26.690Z'
---

## Overview

Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers.

Affected versions:
Spring Cloud Gateway 3.1.x (fix 3.1.13).
Spring Cloud Gateway 4.1.x (fix 4.1.13).
Spring Cloud Gateway 4.2.x (fix 4.2.9).
Spring Cloud Gateway 4.3.x (fix 4.3.5).
Spring Cloud Gateway 5.0.x (fix 5.0.2).

## Affected

- `spring_cloud_gateway <= 3.1.10`
- `spring_cloud_gateway >= 4.0.0, < 4.1.13`
- `spring_cloud_gateway >= 4.2.0, < 4.2.9`
- `spring_cloud_gateway >= 4.3.0, < 4.3.4.1`
- `spring_cloud_gateway >= 5.0.0, < 5.0.1.1`

## Remediation

Upgrade past the affected range:

- `spring_cloud_gateway 5.0.1.1`