Description
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.
An application should be considered vulnerable when all the following are true:
* The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
* Spring Boot actuator is a dependency.
* The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
* The actuator endpoints are available to attackers.
* The actuator endpoints are unsecured.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Spring | Cloud Gateway | 4.3.x – < 4.3.1, 4.2.x – < 4.2.5, 4.1.x, 4.0.x – < 4.1.11, 3.1.x – < 3.1.11 | 4.3.1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
SFN233/CVE-2025-41243-Vulnerability-Lab ★ 0 · Jan 26, 2026
Spring Cloud Gateway SpEL RCE Vulnerability Environment
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Spring Cloud Gateway Server Webflux - Broken Access Control http/cves/2025/CVE-2025-41243.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.springframework.cloud:spring-cloud-gateway-server-webflux | >= 3.1.0, <= 3.1.10 | — | GHSA-q2cj-h8fw-q4cc |
| Maven | org.springframework.cloud:spring-cloud-gateway-server-webflux | >= 4.0.0, <= 4.1.10 | — | GHSA-q2cj-h8fw-q4cc |
| Maven | org.springframework.cloud:spring-cloud-gateway-server-webflux | >= 4.2.0, < 4.2.5 | 4.2.5 | GHSA-q2cj-h8fw-q4cc |
| Maven | org.springframework.cloud:spring-cloud-gateway-server-webflux | >= 4.3.0, < 4.3.1 | 4.3.1 | GHSA-q2cj-h8fw-q4cc |
Advisories 1
- WID-SEC-2025-1996 VMware Tanzu Spring Cloud: Schwachstelle ermöglicht Manipulation von Daten BSI CERT-Bund (WID) · Dec 17, 2025