CVE-2025-41243: RCE in Spring Cloud Gateway

The impact of CVE-2025-41243 is severe. Successful exploitation allows an attacker to execute arbitrary code within the context of the Spring Cloud Gateway application. This could lead to complete system compromise, including data exfiltration, denial of service, and further lateral movement within the network. The vulnerability's reliance on exposed actuator endpoints means that applications with misconfigured security settings are particularly vulnerable. The ability to modify environment properties provides a flexible attack surface, potentially bypassing traditional security controls. This vulnerability shares similarities with other Spring framework vulnerabilities where improper configuration of actuator endpoints has led to exploitation.

1. Reserved2025-04-16
2. Published2025-09-16
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-41243 is to upgrade to Spring Cloud Gateway version 4.3.1 or later. If upgrading is not immediately feasible, consider disabling the actuator endpoints by setting management.endpoints.web.exposure.include=none in your application configuration. Alternatively, restrict access to the actuator endpoints using authentication and authorization mechanisms, such as Spring Security. Implement a Web Application Firewall (WAF) with rules to block requests targeting the actuator endpoints. Monitor application logs for suspicious activity related to actuator endpoint access and environment property modifications. After upgrading, confirm the fix by attempting to access the actuator endpoint with unauthorized credentials and verifying that access is denied.