CVE-2026-47825: Spring Cloud Gateway SSRF Vulnerability

CVE-2026-47825 Overview

CVE-2026-47825 affects Spring Cloud Gateway Server, which forwards X-Forwarded-For and Forwarded headers from untrusted proxies in specific configuration scenarios. Both the WebMVC and WebFlux Gateway Server variants are impacted. The flaw is classified under CWE-346: Origin Validation Error, allowing attacker-controlled client IP information to reach downstream services. Applications that rely on forwarded headers for access control, audit logging, or rate limiting can be misled into trusting attacker-supplied values.

Critical Impact
Downstream services receive unvalidated X-Forwarded-For and Forwarded headers, enabling IP spoofing that subverts allow-listing, geolocation enforcement, and audit trails.

Affected Products

Spring Cloud Gateway 3.1.x (fixed in 3.1.13)
Spring Cloud Gateway 4.1.x (fixed in 4.1.13), 4.2.x (fixed in 4.2.9), 4.3.x (fixed in 4.3.5)
Spring Cloud Gateway 5.0.x (fixed in 5.0.2)

Discovery Timeline

2026-06-15 - CVE-2026-47825 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-47825

Vulnerability Analysis

Spring Cloud Gateway sits in front of microservice backends and routes HTTP traffic. Gateways commonly strip or rewrite client-supplied X-Forwarded-For and Forwarded headers to prevent spoofing, then append the verified upstream peer address. Under the configurations covered by CVE-2026-47825, the Gateway propagates these headers from untrusted clients without sanitization. Downstream applications consume those values as authoritative source-IP indicators.

The impact concentrates on integrity. An attacker controls what the backend perceives as the originating IP, which corrupts access-control decisions and audit records. Confidentiality and availability are not directly affected, but secondary impacts include bypass of IP allow-lists, evasion of rate-limit thresholds, and forging entries in security logs that feed SIEM correlation rules.

Root Cause

The defect is an origin validation error [CWE-346]. The Gateway fails to distinguish between headers received from a trusted proxy chain and those injected by an arbitrary client. In certain combinations of the trustedProxies, forwarded, and x-forwarded filter properties, the inbound header is forwarded verbatim instead of being replaced or removed.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An unauthenticated remote attacker sends a crafted HTTP request that includes an X-Forwarded-For or Forwarded header with a spoofed IP. The Gateway forwards the header to the upstream service, which then trusts the attacker-supplied value. Refer to the Spring Security Advisory CVE-2026-47825 for the precise configuration combinations that expose the flaw.

Detection Methods for CVE-2026-47825

Indicators of Compromise

Backend application logs showing source IPs inconsistent with the Gateway's known upstream peers or load balancer ranges.
Inbound HTTP requests at the Gateway carrying client-supplied Forwarded or X-Forwarded-For headers that survive into upstream request logs unchanged.
Authentication or admin-panel access events recorded from internal or trusted-range IPs that do not match the user's actual session origin.

Detection Strategies

Compare X-Forwarded-For values logged at the edge load balancer with the values logged at backend services to detect propagation of untrusted headers.
Alert on requests where downstream services observe RFC1918 or loopback addresses in X-Forwarded-For that should never originate from external clients.
Inspect Spring Cloud Gateway configuration for missing trustedProxies settings and absent RemoveRequestHeader filters for Forwarded and X-Forwarded-* headers.

Monitoring Recommendations

Enable verbose request-header logging at both Gateway and upstream tiers to maintain a header-provenance audit trail.
Forward Gateway access logs to a centralized analytics platform and create detections for repeated header anomalies from the same TCP source.
Track release versions of Spring Cloud Gateway across the environment and alert when vulnerable builds are deployed.

How to Mitigate CVE-2026-47825

Immediate Actions Required

Upgrade Spring Cloud Gateway to a fixed release: 3.1.13, 4.1.13, 4.2.9, 4.3.5, or 5.0.2.
Inventory all Gateway deployments, including WebMVC and WebFlux variants, and prioritize internet-facing instances.
Audit downstream services that rely on X-Forwarded-For or Forwarded for security decisions and re-validate their trust model.

Patch Information

Upgrade to Spring Cloud Gateway 3.1.13, 4.1.13, 4.2.9, 4.3.5, or 5.0.2 per the Spring Security Advisory CVE-2026-47825. The patched releases correctly strip or replace untrusted X-Forwarded-For and Forwarded headers before forwarding to upstream services.

Workarounds

Configure the RemoveRequestHeader filter for Forwarded, X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto on all routes until the patch is applied.
Define an explicit trustedProxies list so the Gateway only honors forwarded headers received from known upstream load balancers.
Stop using client-IP headers for security-relevant logic in downstream services, and rely on the Gateway's authenticated session context instead.

bash

# Example Spring Cloud Gateway configuration: strip client-supplied forwarding headers
spring:
  cloud:
    gateway:
      default-filters:
        - RemoveRequestHeader=Forwarded
        - RemoveRequestHeader=X-Forwarded-For
        - RemoveRequestHeader=X-Forwarded-Host
        - RemoveRequestHeader=X-Forwarded-Proto
      trusted-proxies: "10.0.0.0/8,192.168.0.0/16"