Spring Cloud Gateway SSL Bundle Config Ignored (CVE-2026-22750)
CVE-2026-22750 Published on April 10, 2026

SSL bundle configuration silently bypassed in Spring Cloud Gateway
When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0  available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.

NVD

Vulnerability Analysis

CVE-2026-22750 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, a high impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
HIGH
Availability Impact:
NONE

Weakness Type

External Control of System or Configuration Setting

One or more system settings or configuration elements can be externally controlled by a user. Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.


Products Associated with CVE-2026-22750

stack.watch emails you whenever new vulnerabilities are published in VMware Spring Framework or VMware Spring Cloud Gateway. Just hit a watch button to start following.

VMware Spring Framework
 
VMware Spring Cloud Gateway
 

Affected Versions

VMware Spring Cloud Gateway:

Exploit Probability

EPSS
0.03%
Percentile
9.85%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.