CVE-2025-41243 (CVSS 10): Critical Spring Cloud Gateway Server WebFlux Flaw Exposes Property Modification Risk

CVE-2025-41243 (CVSS 10): a critical flaw in Spring Cloud Gateway Server WebFlux could let attackers modify Spring Environment properties under specific configurations.

According to the advisory, “Spring Expression Language property modification using Spring Cloud Gateway Server WebFlux.” The vulnerability arises when actuator endpoints are exposed without proper security controls, and an application is vulnerable if it uses Spring Cloud Gateway Server WebFlux, includes Spring Boot actuator, has the actuator web endpoint explicitly enabled via management.endpoints.web.exposure[.]include=gateway, and actuator endpoints are available and unsecured.

This chain could allow manipulation of sensitive runtime properties, potentially altering application behaviour. Pivotal recommends upgrading to patched versions: 4.3.x to 4.3.1 OSS, 4.2.x to 4.2.5 OSS, 4.1.x to 4.1.11 Enterprise, and 3.1.x to 3.1.11 Enterprise, with older 4.0.x branches out of support and migration advised. If upgrading isn’t possible, removing gateway from the exposure property and securing actuator endpoints with authentication and access controls are advised.