CVE-2025-41243
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.
An application should be considered vulnerable when all the following are true:
- The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
- Spring Boot actuator is a dependency.
- The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
- The actuator endpoints are available to attackers.
- The actuator endpoints are unsecured.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.
An application should be considered vulnerable when all the following are true:
- The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
- Spring Boot actuator is a dependency.
- The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
- The actuator endpoints are available to attackers.
- The actuator endpoints are unsecured.
- Record
CVE-2025-41243- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-917, CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2025-29611
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.
An application should be considered vulnerable when all the following are true:
- The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
- Spring Boot actuator is a dependency.
- The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
- The actuator endpoints are available to attackers.
- The actuator endpoints are unsecured.
- Record
EUVD-2025-29611- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q2cj-h8fw-q4cc
Spring Expression language property modification using Spring Cloud Gateway Server WebFlux
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.
An application should be considered vulnerable when all the following are true:
- The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
- Spring Boot actuator is a dependency.
- The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
- The actuator endpoints are available to attackers.
- The actuator endpoints are unsecured.
- Record
GHSA-q2cj-h8fw-q4cc- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.
An application should be considered vulnerable when all the following are true:
- The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
- Spring Boot actuator is a dependency.
- The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
- The actuator endpoints are available to attackers.
- The actuator endpoints are unsecured.
- Record
CVE-2025-41243- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94, CWE-917
- Updated
- 2026-11-02
OSVGHSA-q2cj-h8fw-q4cc
Spring Expression language property modification using Spring Cloud Gateway Server WebFlux
Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.
An application should be considered vulnerable when all the following are true:
- The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).
- Spring Boot actuator is a dependency.
- The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.
- The actuator endpoints are available to attackers.
- The actuator endpoints are unsecured.
- Record
GHSA-q2cj-h8fw-q4cc- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-41243 No score
CVE-2025-41243 in org.springframework.cloud:spring-cloud-gateway-server-webflux - Patched by Root
Root has patched CVE-2025-41243 in the org.springframework.cloud:spring-cloud-gateway-server-webflux package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-41243- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.cloud:spring-cloud-gateway-server-webfluxMaven |
3.1.0 to 3.1.10 | None known |
org.springframework.cloud:spring-cloud-gateway-server-webfluxMaven |
4.0.0 to 4.1.10 | None known |
org.springframework.cloud:spring-cloud-gateway-server-webfluxMaven |
4.2.0 up to 4.2.5 | 4.2.5 |
org.springframework.cloud:spring-cloud-gateway-server-webfluxMaven |
4.3.0 up to 4.3.1 | 4.3.1 |
org.springframework.cloud:spring-cloud-gateway-server-webfluxRoot:Maven |
before 4.3.0-aikido.1 | 4.3.0-aikido.1 |
io.root.org.springframework.cloud:spring-cloud-gateway-server-webfluxRoot:Maven |
before 4.3.0-root.io.1 | 4.3.0-root.io.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Spring Cloud Gateway Server Webflux - Broken Access Control | |
| PoC in GitHub | SFN233/CVE-2025-41243-Vulnerability-Lab | 2026-01-26 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-41243 is a critical vulnerability (CVSS 10.0) in Spring Cloud Gateway, published September 16, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.67%, the 89th percentile. Fixed in org.springframework.cloud:spring-cloud-gateway-server-webflux 4.2.5.