CVE-2026-41847 Overview
CVE-2026-41847 is a security bypass vulnerability in Spring WebFlux applications that use the Kotlin Router Domain Specific Language (DSL). The flaw affects Spring Framework versions 5.3.0 through 5.3.48 and is categorized under CWE-284: Improper Access Control. An attacker can craft requests that bypass intended security constraints defined through the Kotlin Router DSL. The issue is tracked in the Spring Security Advisory CVE-2026-41847.
Critical Impact
Attackers may bypass route-based security controls in affected Spring WebFlux applications, gaining limited unauthorized access to protected resources.
Affected Products
- Spring Framework 5.3.0 through 5.3.48
- Spring WebFlux applications using the Kotlin Router DSL
- Reactive Spring services that rely on Kotlin DSL route security configuration
Discovery Timeline
- 2026-06-09 - CVE-2026-41847 published to the National Vulnerability Database (NVD)
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-41847
Vulnerability Analysis
The vulnerability resides in how Spring WebFlux processes routes declared with the Kotlin Router DSL. The Kotlin DSL provides a fluent syntax for defining reactive HTTP routes and applying filters such as authentication and authorization predicates. Under specific conditions, requests can be routed in a way that does not apply the configured security predicates as expected. This allows an attacker to reach handler functions without satisfying the access control checks intended by the developer.
The weakness maps to CWE-284: Improper Access Control. Exploitation requires crafted requests that exploit the DSL's routing semantics, which contributes to the higher attack complexity reflected in the scoring. The Exploit Prediction Scoring System (EPSS) currently lists the probability at a low level, and no public proof-of-concept exploit has been published as of the NVD entry.
Root Cause
The root cause is improper enforcement of security predicates within the Kotlin Router DSL route matching logic in Spring Framework 5.3.0 through 5.3.48. Filters intended to gate access to nested routes are not consistently evaluated for all matching request patterns, leaving paths reachable without the associated authorization check.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. A remote attacker sends crafted HTTP requests to a vulnerable Spring WebFlux endpoint defined through the Kotlin Router DSL. When the routing layer fails to apply the security predicate, the protected handler executes and may return data or perform actions that should require prior authorization. Exploitation requires knowledge of the application's route structure, which raises attack complexity.
No verified public exploit code is available. Refer to the Spring Security Advisory CVE-2026-41847 for vendor technical details.
Detection Methods for CVE-2026-41847
Indicators of Compromise
- Successful HTTP responses (2xx) on routes that normally require authentication, originating from unauthenticated sessions
- Access log entries showing handler execution without preceding authentication or authorization events
- Unusual request patterns probing Kotlin DSL route prefixes followed by sensitive sub-paths
Detection Strategies
- Inventory Spring Framework deployments and identify applications running versions 5.3.0 through 5.3.48 with Kotlin Router DSL usage
- Review application access logs for requests to protected routes that lack corresponding authentication events
- Add server-side logging to security predicates to confirm they execute for every request reaching nested handlers
Monitoring Recommendations
- Forward Spring application logs and reverse proxy logs to a centralized SIEM for correlation between authentication and resource access events
- Alert on anomalous access ratios where protected endpoints serve requests without prior authenticated session identifiers
- Track Spring Framework version metadata across the estate and flag deployments still on vulnerable 5.3.x builds
How to Mitigate CVE-2026-41847
Immediate Actions Required
- Upgrade Spring Framework to a fixed release as published in the Spring Security Advisory CVE-2026-41847
- Audit all Kotlin Router DSL route definitions and confirm that security filters wrap the intended nested routes
- Restrict network exposure of affected WebFlux services until patches are deployed
Patch Information
Spring has published guidance and fixed versions in the Spring Security Advisory CVE-2026-41847. Application teams should upgrade Spring Framework beyond 5.3.48 on the 5.3.x branch or migrate to a current supported release line. Rebuild and redeploy WebFlux applications after dependency updates and validate route security with integration tests.
Workarounds
- Replace Kotlin Router DSL security predicates with explicit Spring Security SecurityWebFilterChain configuration that enforces authorization at the filter chain level
- Add a reverse proxy or API gateway rule that requires authentication for sensitive paths until application-level patches are deployed
- Implement explicit authorization checks inside handler functions as defense-in-depth while remediation is in progress
# Example: enforce upgrade by pinning a fixed Spring Framework version in Gradle
# Replace <FIXED_VERSION> with the version listed in the Spring advisory
./gradlew dependencyInsight --dependency org.springframework:spring-webflux
./gradlew build --refresh-dependencies
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
