CVE-2026-47879 — Spring Cloud Gateway SSRF and native file access with gRPC

CVE-2026-47879

Spring Cloud Gateway SSRF and native file access with gRPC PUBLISHED

Description (CNA)

Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier

Affected (CNA)

Vendor / product	Versions
Spring / Spring Cloud Gateway	affected 5.0.0 through 5.0.2; affected 4.3.0 through 4.3.5; affected 4.0.0 through 4.2.9; affected 0 through 3.1.13

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47879

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.