CVE-2026-47879 - Vulnerability Details - OpenCVE

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Spring	Spring Cloud Gateway

No data.

No data.

References

Link	Providers
https://spring.io/security/cve-2026-47879

History

Thu, 27 Aug 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200 CWE-294

Thu, 27 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-918
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 27 Aug 2026 09:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spring Spring spring Cloud Gateway
Vendors & Products		Spring Spring spring Cloud Gateway

Thu, 27 Aug 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-200 CWE-294

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier
Title		Spring Cloud Gateway SSRF and native file access with gRPC
References		https://spring.io/security/cve-2026-47879
Metrics		cvssV3_1 `{'score': 7.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2026-08-27T05:20:24.412Z

Updated: 2026-08-27T14:28:03.681Z

Reserved: 2026-05-20T10:00:58.694Z

Link: CVE-2026-47879

Vulnrichment

Updated: 2026-08-27T14:26:40.223Z

NVD

Status : Awaiting Analysis

Published: 2026-08-27T06:17:17.813

Modified: 2026-08-28T18:47:30.163

Link: CVE-2026-47879

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47879", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-05-20T10:00:58.694Z", "datePublished": "2026-08-27T05:20:24.412Z", "dateUpdated": "2026-08-27T14:28:03.681Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-27T05:21:30.355Z"}, "title": "Spring Cloud Gateway SSRF and native file access with gRPC", "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor."}]}], "affected": [{"vendor": "Spring", "product": "Spring Cloud Gateway", "versions": [{"status": "affected", "version": "5.0.0", "lessThanOrEqual": "5.0.2", "versionType": "custom"}, {"status": "affected", "version": "4.3.0", "lessThanOrEqual": "4.3.5", "versionType": "custom"}, {"status": "affected", "version": "4.0.0", "lessThanOrEqual": "4.2.9", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThanOrEqual": "3.1.13", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.\nSpring Cloud Gateway 5.0.0 - 5.0.2\nSpring Cloud Gateway 4.3.0 - 4.3.5\nSpring Cloud Gateway 4.0.0 - 4.2.9\nSpring Cloud Gateway 3.1.13 and earlier", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.</p><p>Spring Cloud Gateway 5.0.0 - 5.0.2<br/>Spring Cloud Gateway 4.3.0 - 4.3.5<br/>Spring Cloud Gateway 4.0.0 - 4.2.9<br/>Spring Cloud Gateway 3.1.13 and earlier</p>"}]}], "references": [{"url": "https://spring.io/security/cve-2026-47879"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N", "baseScore": 7.7, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}}], "source": {"discovery": "UNKNOWN"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-27T14:25:43.054745Z", "id": "CVE-2026-47879", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T14:28:03.681Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47879", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T14:25:43.054745Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T14:26:40.223Z"}}], "cna": {"title": "Spring Cloud Gateway SSRF and native file access with gRPC", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Spring Cloud Gateway", "versions": [{"status": "affected", "version": "5.0.0", "versionType": "custom", "lessThanOrEqual": "5.0.2"}, {"status": "affected", "version": "4.3.0", "versionType": "custom", "lessThanOrEqual": "4.3.5"}, {"status": "affected", "version": "4.0.0", "versionType": "custom", "lessThanOrEqual": "4.2.9"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.1.13"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-47879"}], "descriptions": [{"lang": "en", "value": "Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.\nSpring Cloud Gateway 5.0.0 - 5.0.2\nSpring Cloud Gateway 4.3.0 - 4.3.5\nSpring Cloud Gateway 4.0.0 - 4.2.9\nSpring Cloud Gateway 3.1.13 and earlier", "supportingMedia": [{"type": "text/html", "value": "<p>Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor.</p><p>Spring Cloud Gateway 5.0.0 - 5.0.2<br/>Spring Cloud Gateway 4.3.0 - 4.3.5<br/>Spring Cloud Gateway 4.0.0 - 4.2.9<br/>Spring Cloud Gateway 3.1.13 and earlier</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-27T05:21:30.355Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47879", "state": "PUBLISHED", "dateUpdated": "2026-08-27T14:28:03.681Z", "dateReserved": "2026-05-20T10:00:58.694Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-08-27T05:20:24.412Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}