Executive brief
Spring Cloud Gateway, a tool used to route and manage web traffic, contains a configuration flaw where custom security settings (SSL bundles) are silently ignored. Instead of using the administrator's intended security certificates and protocols, the system reverts to default settings. This could lead to connections being secured with weaker or incorrect credentials than required by corporate policy.
Technical details
A vulnerability in Spring Cloud Gateway (CWE-15) occurs when configuring SSL bundles using the 'spring.ssl.bundle' property. The application silently ignores these custom configurations and falls back to the default SSL configuration. This issue affects Spring Cloud Gateway version 4.2.0 and early versions of the 5.0.x and 5.1.x branches. An attacker could potentially exploit this if the default configuration is less secure than the intended bundle, though the CVSS indicates impact primarily on integrity. Users are advised to upgrade to versions 5.0.2, 5.1.1, or a patched 4.2.x release.
Affected products
- VMware Spring Cloud Gateway 4.2.0, 5.0.0 - 5.0.1, 5.1.0
Timeline
- 2026-04-10: disclosed
- 2026-04-10: advisory