Spring Cloud Gateway Server Webflux Vulnerability Exposes Sensitive Data

CVE-2025-41253

What is CVE-2025-41253?

The Spring Cloud Gateway Server Webflux could unintentionally expose environment variables and system properties if specific configurations are not secured. An attacker could leverage Spring Expression Language (SpEL) in routes to gain unauthorized access to sensitive data. This risk is present when the actuator endpoints are unsecured and publicly available, particularly if management endpoints are exposed without restrictions. It’s critical for users to ensure that these settings are properly configured to prevent potential exploitation.

References