Description

The following versions of Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.

An application should be considered vulnerable when all the following are true:

• The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
• Spring Boot actuator is a dependency.
• The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
• The actuator endpoints are available to attackers.
• The actuator endpoints are unsecured.

Affected Spring Products and Versions

Spring Cloud Gateway:

• 4.3.0 - 4.3.x
• 4.2.0 - 4.2.x
• 4.1.0 - 4.1.x
• 4.0.0 - 4.0.x
• 3.1.0 - 3.1.x
• Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

If you cannot upgrade, then you can:

1. Remove gateway from the management.endpoints.web.exposure.include property or secure the actuator endpoints.

Credit

This issue was responsibly reported by Ezzer17.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H&version=3.1

History

• 2025-09-08: Initial vulnerability report published.