CVE-2026-47825: Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations

Synopsis

A header-forwarding vulnerability affects Spring Cloud Gateway Server (both WebMVC and WebFlux variants) across multiple release lines. The gateway incorrectly forwards X-Forwarded-For and Forwarded headers originating from untrusted proxies to upstream services, which can let an attacker spoof their source IP address or manipulate routing and access-control logic that depends on those headers. Exploitation requires no authentication and is reachable over the network, enabling an attacker to tamper with integrity-sensitive header values seen by downstream services. Patched-image rebuilds at versions 3.1.13, 4.1.13, 4.2.9, 4.3.5, and 5.0.2 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Spring Cloud Gateway service over the network to inject or manipulate forwarding headers.

• AuthenticationNot required

  No account or credential is needed; the attack can be carried out by any unauthenticated network client.

• Victim interactionNot required

  No user action is required; the gateway processes the malicious headers automatically upon receiving the request.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, requiring no race conditions, memory layout knowledge, or other environmental factors.

Blast Radius

• An attacker can inject a forged X-Forwarded-For or Forwarded header that upstream services receive as authoritative, bypassing IP-based access controls or allow-lists.
• Rate-limiting, geo-restriction, or fraud-detection logic that trusts these headers can be defeated, allowing the attacker to masquerade as a trusted network source.
• Audit and access logs populated from forwarding headers record the spoofed address rather than the real origin, undermining forensic accuracy.