High severity · published Apr 10, 2026
CVE-2026-22750
SSL bundle configuration silently bypassed in Spring Cloud Gateway
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead.
Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Spring Cloud Gateway · VMware
4.2.0 before 4.2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22750
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22750
Vendor Advisory
https://spring.io/security/cve-2026-22750
More from Spring Cloud Gateway
10.0
CVE-2022-22947
VMware Spring Cloud Gateway Code Injection Vulnerability
8.7
CVE-2026-47879
Spring Cloud Gateway SSRF and native file access with gRPC
8.6
CVE-2026-47825
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies in certain situations
6.5
CVE-2021-22051
Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services
5.5
CVE-2022-22946
In spring cloud gateway versions prior to 3.1.1+ , applications that are configured to enable HTTP2 and no key store or trusted certificates are set will be configured to use an…