CVE-2026-47892: Spring Framework Auth Bypass Vulnerability

CVE-2026-47892 Overview

CVE-2026-47892 affects Spring Framework WebFlux applications that use functional endpoints and are deployed with DispatcherServlet. The vulnerability allows attackers to bypass header predicates through crafted Cross-Origin Resource Sharing (CORS) pre-flight requests. Header predicates are commonly used to enforce routing rules and access constraints based on request headers. When bypassed, a pre-flight request can reach handlers that were intended to be restricted by header-based conditions. The issue impacts multiple supported Spring Framework branches, including the 7.x, 6.x, and 5.x lines.

Critical Impact
Attackers can bypass header-based routing predicates in WebFlux functional endpoints served by DispatcherServlet, potentially reaching restricted handlers through pre-flight requests.

Affected Products

Spring Framework 7.0.0 - 7.0.8
Spring Framework 6.2.0 - 6.2.19, 6.1.0 - 6.1.28, 6.0.0 - 6.0.30
Spring Framework 5.3.0 - 5.3.49 and 5.2.5.RELEASE - 5.2.25.RELEASE

Discovery Timeline

2026-08-27 - CVE-2026-47892 published to the National Vulnerability Database (NVD)
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47892

Vulnerability Analysis

Spring WebFlux supports a functional routing model where developers compose RouterFunction definitions and attach predicates such as RequestPredicates.headers(...). When a WebFlux application is deployed on top of DispatcherServlet (the Servlet stack) rather than the native reactive runtime, request matching passes through additional CORS handling. During a CORS pre-flight (OPTIONS) request, the server evaluates whether the target route exists before enforcing full predicate logic. In the affected configuration, header predicates are not applied consistently during that pre-flight evaluation.

An attacker can craft an OPTIONS request that omits or manipulates the headers a route expects. The router treats the route as reachable, exposing the existence of a protected endpoint and, depending on downstream logic, enabling bypass of header-gated routing rules. The scope is limited to WebFlux functional endpoints running under DispatcherServlet; annotation-based controllers and pure reactive deployments are not described as affected.

Root Cause

The root cause is inconsistent predicate evaluation during CORS pre-flight processing in the WebFlux-on-Servlet integration path. Header predicates that gate access are not enforced when the request is classified as a pre-flight, resulting in an Authorization Bypass condition tied to request routing.

Attack Vector

An unauthenticated remote attacker sends an HTTP OPTIONS pre-flight request that includes the Origin header and Access-Control-Request-Method header but omits or spoofs the headers required by the route predicate. The request bypasses the predicate check and reveals or reaches the guarded route. No exploit code has been published, and CVE-2026-47892 is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of writing.

See the Spring Security Advisory CVE-2026-47892 for authoritative technical detail.

Detection Methods for CVE-2026-47892

Indicators of Compromise

Unexpected HTTP OPTIONS requests targeting WebFlux functional endpoints with unusual Origin or Access-Control-Request-Headers values.
Successful pre-flight responses (200/204) for endpoints that should require specific request headers.
Access logs showing pre-flight requests followed by main requests that omit headers previously required by routing predicates.

Detection Strategies

Inventory Spring Framework versions across services and flag any deployment combining WebFlux functional endpoints with DispatcherServlet on affected versions.
Instrument RouterFunction handlers to log the presence of predicate-required headers and alert on requests that reach the handler without them.
Compare CORS pre-flight traffic volume and target paths against baseline to spot enumeration attempts.

Monitoring Recommendations

Forward web access logs and application logs to a centralized analytics pipeline for correlation of pre-flight and follow-up requests.
Track anomalous OPTIONS request patterns per client IP, path, and Origin header.
Alert on repeated pre-flight requests to sensitive routes such as administrative or internal APIs.

How to Mitigate CVE-2026-47892

Immediate Actions Required

Upgrade Spring Framework to a fixed release on the branch you run, as listed in the vendor advisory.
Identify WebFlux applications deployed with DispatcherServlet and prioritize them for patching.
Review RouterFunction definitions that rely on headers(...) predicates to enforce authorization or routing constraints.

Patch Information

VMware/Spring has published fixes referenced in the Spring Security Advisory CVE-2026-47892. Consult the advisory for the exact patched versions across the 7.0.x, 6.2.x, 6.1.x, 6.0.x, and 5.3.x branches. Commercial support customers should also review the extended support notes for 5.2.x releases.

Workarounds

Move header-based authorization out of routing predicates and into handler logic or a dedicated WebFilter that runs before dispatch.
Restrict CORS configuration so that pre-flight requests from untrusted origins are rejected before reaching functional routes.
Where feasible, redeploy affected WebFlux applications on the native reactive runtime rather than DispatcherServlet until patches are applied.

bash

# Configuration example: enforce strict CORS and header checks in a WebFilter
# Apply an explicit filter that validates required headers on all methods,
# including OPTIONS pre-flight requests, before routing takes effect.
# Consult the Spring advisory for vendor-recommended configuration.