Is CVE-2026-22750 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22750 being exploited in the wild.

How severe is CVE-2026-22750?

High severity, with a CVSS score of 7.5, published 10 April 2026.

Which products and versions are affected?

org.springframework.cloud:spring-cloud-gateway (Maven) = 4.2.0, ECOSYSTEM:introduced=4.2.0,fixed=4.2.1; VMware Spring Cloud Gateway 4.2.0, 4.2.0, 5.0.0 - 5.0.1, 5.1.0.

Is there a fix for CVE-2026-22750?

Yes. org.springframework.cloud:spring-cloud-gateway (Maven): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22750 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-22750?

Check whether you run org.springframework.cloud:spring-cloud-gateway (Maven) or VMware Spring Cloud Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22750: VMware Spring Cloud Gateway ignored SSL bundle configuration

CVE-2026-22750 · Severity: high · CVSS 7.5 · Published 2026-04-10

Spring Cloud Gateway, a tool used to route and manage web traffic, contains a configuration flaw where custom security settings (SSL bundles) are silently ignored. Instead of using the administrator's intended security certificates and protocols, the system reverts to default settings. This could lead to connections being secured with weaker or incorrect credentials than required by corporate policy.

Technologies: org.springframework.cloud:spring-cloud-gateway (Maven), VMware Spring Cloud Gateway. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-22750 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22750 being exploited in the wild.
How severe is CVE-2026-22750?: High severity, with a CVSS score of 7.5, published 10 April 2026.
Which products and versions are affected?: org.springframework.cloud:spring-cloud-gateway (Maven) = 4.2.0, ECOSYSTEM:introduced=4.2.0,fixed=4.2.1; VMware Spring Cloud Gateway 4.2.0, 4.2.0, 5.0.0 - 5.0.1, 5.1.0.
Is there a fix for CVE-2026-22750?: Yes. org.springframework.cloud:spring-cloud-gateway (Maven): upgrade to 4.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22750 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-22750?: Check whether you run org.springframework.cloud:spring-cloud-gateway (Maven) or VMware Spring Cloud Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework.cloud:spring-cloud-gateway (Maven): upgrade to 4.2.1 or later

# set org.springframework.cloud:spring-cloud-gateway to 4.2.1 in your pom.xml or build.gradle

Technical details

A vulnerability in Spring Cloud Gateway (CWE-15) occurs when configuring SSL bundles using the 'spring.ssl.bundle' property. The application silently ignores these custom configurations and falls back to the default SSL configuration. This issue affects Spring Cloud Gateway version 4.2.0 and early versions of the 5.0.x and 5.1.x branches. An attacker could potentially exploit this if the default configuration is less secure than the intended bundle, though the CVSS indicates impact primarily on integrity. Users are advised to upgrade to versions 5.0.2, 5.1.1, or a patched 4.2.x release.

Affected products

VMware Spring Cloud Gateway 4.2.0, 5.0.0 - 5.0.1, 5.1.0

Identifiers

CVE-2026-22750
GHSA-hwqh-2684-54fc

Timeline

2026-04-10: disclosed
2026-04-10: advisory

References

https://spring.io/security/cve-2026-22750

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.