CVE-2026-22750: SSL bundle configuration silently bypassed in Spring Cloud Gateway

Published Apr 10, 2026

Updated

When configuring SSL bundles in Spring Cloud Gateway by using the configuration property spring.ssl.bundle, the configuration was silently ignored and the default SSL configuration was used instead. Note: The 4.2.x branch is no longer under open source support. If you are using Spring Cloud Gateway 4.2.0 and are not an enterprise customer, you can upgrade to any Spring Cloud Gateway 4.2.x release newer than 4.2.0 available on Maven Centeral https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-gateway/ . Ideally if you are not an enterprise customer, you should be upgrading to 5.0.2 or 5.1.1 which are the current supported open source releases.

Affected Software

2 affected components

maven/org.springframework.cloud/spring-cloud-gateway=4.2.0

VMware Spring Cloud Gateway=4.2.0

Event History

Apr 10, 2026

CVE Published

via MITRE·07:32 AM

Data Sourced

via MITRE·07:32 AM

DescriptionSeverity

Data Sourced

via NVD·08:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-22750?

CVE-2026-22750 is considered a moderate severity vulnerability due to the bypassing of SSL bundle configuration.

How do I fix CVE-2026-22750?

To fix CVE-2026-22750, upgrade to a version of Spring Cloud Gateway that is not affected, specifically a version beyond 4.2.0.

What systems are affected by CVE-2026-22750?

CVE-2026-22750 affects Spring Cloud Gateway version 4.2.0.

What are the potential impacts of CVE-2026-22750?

The potential impact of CVE-2026-22750 includes the failure to enforce expected SSL configurations, which may expose sensitive data.

Is there a workaround for CVE-2026-22750?

There are no recommended workarounds for CVE-2026-22750; updating to an unaffected version is advised.