External risk intelligence

Spring Framework Header Predicate Bypass in WebFlux Applications

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-47892

The vulnerability affects Spring Framework web applications using functional endpoints and DispatcherServlet. As these components are fundamental building blocks for internet-facing web applications, APIs, and public-facing services, they are commonly exposed to the internet in standard deployment patterns.

Vmware Spring Framework

5.2.5 to before 5.2.265.3.0 to before 5.3.506.0.0 to before 6.0.316.1.0 to before 6.1.296.2.0 to before 6.2.207.0.0 to before 7.0.8.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in certain Spring Framework applications that could allow unauthorized access to sensitive information or systems if exploited. This issue arises from a header predicate bypass within pre-flight requests in WebFlux applications configured with DispatcherServlet.

Bypassed security headers could expose applications.
Critical vulnerability impacts many web applications.
Confirm if your web applications are affected.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a crafted pre-flight request to a WebFlux application that uses functional endpoints and is deployed with DispatcherServlet. This bypasses security checks related to headers, potentially allowing unauthorized access or actions.

Unauthenticated network access is required.
Triggered by a specially crafted pre-flight request.
Allows unauthorized access and data compromise.

Live Threat

Current exploitation, exposure, and threat context

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. This could allow an attacker to bypass security checks.

Web application security controls.
Via crafted pre-flight requests.
Unauthorized access to services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts WebFlux applications utilizing functional endpoints and deployed with DispatcherServlet. Ownership likely lies with the application development or platform teams responsible for these services, who must first identify all instances of the affected Spring Framework versions. The initial practical step involves confirming the reachability and business criticality of these applications to prioritize remediation efforts, potentially coordinating with vendor support if necessary.

Application owners should manage the issue.
Verify application exposure and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Spring Framework and how is it used?

Spring Framework is a widely used Java platform providing comprehensive infrastructure for building modern, enterprise-level web applications and microservices. It simplifies complex tasks like dependency management and web routing. This vulnerability specifically concerns applications utilizing Spring WebFlux, a reactive-stack web framework designed for high-concurrency, non-blocking network interactions.

What does CWE-863 mean for CVE-2026-47892?

CWE-863 refers to 'Incorrect Authorization.' In the context of this CVE, it means the application fails to properly verify that a user has permission to perform an action. Specifically, a flaw in how functional endpoints handle pre-flight requests allows an attacker to bypass header-based security checks, potentially gaining access to protected resources that should have been restricted.

How does an attacker trigger this bypass?

An attacker triggers this by sending a specially crafted pre-flight request, which is an initial check typically used by browsers in cross-origin resource sharing. This bug only occurs in WebFlux applications that also use DispatcherServlet. If your application does not use both functional endpoints and the DispatcherServlet together, it is not susceptible to this specific header predicate bypass.

Do I need to worry if my application is internal?

Halo Surface Signal indicates that because this vulnerability involves fundamental building blocks for web APIs, these components are frequently deployed in internet-facing patterns. While internet-facing applications are at the highest risk for unauthorized access, internal applications using these specific Spring Framework configurations may also be vulnerable if an attacker gains access to your internal network.

When should I prioritize fixing this?

Begin by identifying all applications in your environment that utilize the affected versions of the Spring Framework. Once you have an inventory, prioritize those that are internet-facing or manage sensitive data. Coordinate with your development teams to confirm the specific use of functional endpoints and DispatcherServlet, then plan for necessary updates or configuration changes.

References

spring.io/security/cve-2026-47892

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.