CVE-2026-47879 is a vulnerability in VMware Spring Framework
Published on August 27, 2026
Spring Cloud Gateway SSRF and native file access with gRPC
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.
Spring Cloud Gateway 5.0.0 - 5.0.2
Spring Cloud Gateway 4.3.0 - 4.3.5
Spring Cloud Gateway 4.0.0 - 4.2.9
Spring Cloud Gateway 3.1.13 and earlier
Vulnerability Analysis
CVE-2026-47879 can be exploited with network access, and requires user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Products Associated with CVE-2026-47879
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring Cloud Gateway:- Version 5.0.0, <= 5.0.2 is affected.
- Version 4.3.0, <= 4.3.5 is affected.
- Version 4.0.0, <= 4.2.9 is affected.
- Before and including 3.1.13 is affected.