AIKIDO-2026-790325
spring-cloud-gateway-server-webflux is vulnerable to Server-Side Request Forgery (SSRF)
77
High Risk
This Affects:
spring-cloud-gateway-server-webfluxTL;DR
spring-cloud-gateway-server-webflux JsonToGrpcGatewayFilterFactory accepts arbitrary Spring Resource locations for the proto descriptor. That can be pointed at remote URLs or local files, enabling SSRF and native file access. An attacker who can influence the descriptor location can make the gateway fetch unintended resources. The patch restricts descriptor locations to trusted resources.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and JsonToGrpcGatewayFilterFactory is used with a proto descriptor location from untrusted input.
Background info
spring-cloud-gateway-server-webflux is vulnerable to Server-Side Request Forgery (SSRF) in versions 5.0.0 - 5.0.2.
How to fix this
Upgrade the org.springframework.cloud:spring-cloud-gateway-server-webflux library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant