External risk intelligence

Spring Cloud Gateway Server Webflux Environment Property Modification Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-41243

Spring Cloud Gateway is designed to function as an edge service or API gateway, which are typically deployed as internet-facing components. While the vulnerability requires specific configuration of actuator endpoints, the product role itself is a network edge service that is commonly exposed to the internet in real-world deployments.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability identified in Spring Cloud Gateway Server Webflux, a component often used for managing API traffic. The issue could allow unauthorized modification of system properties if specific conditions related to the Spring Boot Actuator are met and accessible. The main concern is to confirm whether our environment utilizes this specific configuration and is exposed.

System settings can be changed.
Critical gateways process external traffic.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to an exposed and unsecured Spring Cloud Gateway actuator endpoint. This could allow them to modify sensitive environment properties, potentially leading to significant compromise of the application.

Requires exposed, unsecured actuator endpoint.
Triggered by requests to the gateway endpoint.
Allows sensitive property modification.

Live Threat

Current exploitation, exposure, and threat context

When Spring Cloud Gateway Server Webflux is configured with Spring Boot Actuator enabled and exposed over the network without security, an attacker could modify Spring Environment properties. This could potentially impact the application's configuration and behavior.

Sensitive configuration data.
Unsecured Actuator endpoints.
Alter application behavior.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Spring Cloud Gateway Server Webflux when Spring Boot actuator is enabled and exposed insecurely. Application owners or platform teams responsible for API gateways and their configurations should lead the initial triage. The first practical move is to identify all instances of Spring Cloud Gateway Server Webflux, determine their exposure, and ascertain if the actuator endpoints are accessible and unsecured. Based on this exposure, prioritize remediation planning with relevant infrastructure and security teams.

Application owners should own remediation.
Verify actuator endpoint exposure and security.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Spring Cloud Gateway Server Webflux?

It is a framework component built for Java applications that acts as an API gateway. Developers use it to route, manage, and protect incoming network traffic before it reaches backend microservices. Unlike the WebMVC version, the Webflux variant is specifically designed for high-concurrency, non-blocking network operations, often serving as the primary entry point for modern application architectures.

What does this CVE mean for my application security?

CVE-2025-41243 involves a vulnerability classified as CWE-94 (Improper Control of Generation of Code) and CWE-917 (Improper Neutralization of Special Elements used in an Expression Language). In plain terms, it allows an attacker to manipulate the internal configuration settings of your application. By modifying these properties, an unauthorized user can potentially alter how your software behaves or accesses sensitive data.

How is this vulnerability triggered?

An attacker triggers this issue by sending malicious requests to a specific actuator endpoint that has been left unsecured. Importantly, the vulnerability is not triggered if your Spring Boot actuator endpoints are properly secured or if the gateway endpoint is disabled. The condition requires a combination of the gateway being active, the actuator dependency being present, and that management endpoint being reachable by an unauthorized party.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal notes that because Spring Cloud Gateway is inherently designed to function as an edge service or API gateway, it is frequently deployed facing the internet. If your instance is configured with public-facing actuator endpoints that lack authentication, the risk is elevated because the component is intended to handle external traffic, making it a natural target for network-based probes.

What should I do first to address this?

Start by auditing your application inventory to locate all instances of Spring Cloud Gateway Server Webflux. Once identified, verify if the Spring Boot actuator is enabled and if the 'gateway' management endpoint is exposed to the network. If you find such endpoints, ensure they are restricted from public access and protected with appropriate authentication as a priority step while planning further configuration hardening.

References

spring.io/security/cve-2025-41243

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.