CVE-2026-22750
SSL Configuration Bypass in Spring Cloud Gateway 4.2.x
Publication date: 2026-04-10
Last updated on: 2026-04-10
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vmware | spring_cloud_gateway | to 4.2.1 (exc) |
| vmware | spring_cloud_gateway | From 4.2.1 (inc) |
| vmware | spring_cloud_gateway | 5.0.2 |
| vmware | spring_cloud_gateway | 5.1.1 |
| spring_project | spring_cloud_gateway | From 4.2.0 (exc) |
| spring_project | spring_cloud_gateway | 5.0.2 |
| spring_project | spring_cloud_gateway | 5.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-15 | One or more system settings or configuration elements can be externally controlled by a user. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22750 is a high-severity vulnerability in Spring Cloud Gateway version 4.2.0 where the SSL bundle configuration property `spring.ssl.bundle` is silently ignored during configuration.
Instead of applying the specified SSL bundle settings, the system defaults to the standard SSL configuration without notifying the user, which can lead to insecure or unintended SSL behavior.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability occurs when the SSL bundle configuration property `spring.ssl.bundle` is silently ignored in Spring Cloud Gateway version 4.2.0, causing the system to use the default SSL configuration instead.
To detect if your system is affected, you should first identify the version of Spring Cloud Gateway running in your environment. If it is version 4.2.0, it is vulnerable.
You can check the version of Spring Cloud Gateway by inspecting your application's dependencies or runtime environment. For example, if you have access to the server or container running the application, you might use commands like:
- Check the version in the Maven dependencies (if applicable): `mvn dependency:list | grep spring-cloud-gateway`
- If the application is packaged as a jar, inspect the manifest or use: `java -jar your-app.jar --version` (if supported)
- Check running processes or logs for Spring Cloud Gateway version information.
Since the vulnerability is related to configuration being ignored silently, there is no direct network signature or command to detect the misconfiguration remotely.
The best detection method is verifying the version and reviewing your SSL configuration settings to ensure `spring.ssl.bundle` is applied correctly or upgrading to a fixed version.
How can this vulnerability impact me? :
Because the SSL bundle configuration is ignored and the default SSL settings are used instead, users may unknowingly operate with less secure SSL configurations than intended.
This can lead to a high integrity impact, meaning attackers could potentially interfere with or alter data in transit without detection.
The vulnerability has a CVSS score of 7.5, indicating it is exploitable remotely with low complexity and no privileges or user interaction required.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the vulnerability in Spring Cloud Gateway 4.2.0 where the SSL bundle configuration is ignored, you should upgrade your Spring Cloud Gateway version.
- If you have enterprise support, upgrade to version 4.2.1 or any newer release within the 4.2.x series.
- If you are not an enterprise customer, upgrade to the currently supported open source releases, specifically versions 5.0.2 or 5.1.1.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability causes the SSL bundle configuration to be silently ignored, resulting in the use of default SSL settings instead of the intended secure configuration.
Because SSL configurations are critical for protecting data in transit, this misconfiguration could lead to weaker encryption or unintended SSL behavior, potentially exposing data to interception or tampering.
Such exposure or integrity compromise of data in transit may negatively impact compliance with standards and regulations like GDPR and HIPAA, which require appropriate safeguards to protect sensitive data.
However, the CVE description and resources do not explicitly mention compliance impacts or regulatory considerations.