CVE-2026-47892

Analyzed Analyzed - Analysis Complete

Header Predicate Bypass in Spring Framework WebFlux Applications

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47892

EUVD

EUVD-2026-66860

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_framework	From 6.2.0 (inc) to 6.2.20 (exc)
vmware	spring_framework	From 6.1.0 (inc) to 6.1.29 (exc)
vmware	spring_framework	From 5.3.0 (inc) to 5.3.50 (exc)
vmware	spring_framework	From 6.0.0 (inc) to 6.0.31 (exc)
vmware	spring_framework	From 7.0.0 (inc) to 7.0.8.1 (exc)
vmware	spring_framework	From 5.2.5 (inc) to 5.2.26 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability affects WebFlux applications using functional endpoints deployed with DispatcherServlet. It allows bypassing header predicates in pre-flight requests, potentially enabling unauthorized access or manipulation of application behavior.

Detection Guidance

Detection requires checking if your Spring Framework version falls within the vulnerable ranges. Use commands like 'curl -I http://yourserver:port' to inspect headers or check version via 'find / -name spring-core*.jar 2>/dev/null' and inspect MANIFEST.MF for version details.

Impact Analysis

An attacker could exploit this to bypass security checks in pre-flight requests, potentially gaining unauthorized access to restricted resources or performing actions they shouldn't be able to.

Compliance Impact

The vulnerability involves a header predicate bypass in pre-flight requests for WebFlux applications using functional endpoints with DispatcherServlet. This could potentially allow unauthorized cross-origin requests, which may impact data protection measures required by GDPR and HIPAA if sensitive data is exposed or improperly accessed.

Mitigation Strategies

Upgrade to the fixed versions: 7.0.9, 7.0.8.1 (Enterprise), 6.2.20 (Enterprise), 6.1.29 (Enterprise), 6.0.31 (Enterprise), 5.3.50 (Enterprise), or 5.2.26 (Enterprise). No other mitigation is required beyond upgrading.

Hi! I’m here to help you understand CVE-2026-47892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70