Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Spring WebFlux may let unwanted headers bypass checks

CVE-2026-47892 · published 2 months ago
Summary

If you run a Spring WebFlux application that uses functional endpoints and a DispatcherServlet, certain older versions could let a specially crafted pre‑flight request skip header checks. This could allow an attacker to send requests that the application thinks are safe, potentially exposing data or actions. Update Spring Framework to the newest release for your version line to close the gap.

What to do
  • Update org.springframework:spring-webflux to version 7.0.9.
  • Update org.springframework:spring-webflux to version 6.1.15-aikido.2.
  • Update io.root.org.springframework:spring-webflux to version 6.1.15-root.io.2.
Affected software
Ecosystem VendorProductAffected versions
– spring spring framework <= 7.0.8
Ubuntu:Pro:14.04:LTS canonical libspring-java All versions
Ubuntu:Pro:16.04:LTS canonical libspring-java All versions
Ubuntu:Pro:18.04:LTS canonical libspring-java All versions
Ubuntu:Pro:20.04:LTS canonical libspring-java All versions
Ubuntu:Pro:22.04:LTS canonical libspring-java All versions
Ubuntu:Pro:24.04:LTS canonical libspring-java All versions
Ubuntu:26.04:LTS canonical libspring-java All versions
– vmware spring_framework >= 5.2.5, < 5.2.26
>= 5.3.0, < 5.3.50
>= 6.0.0, < 6.0.31
>= 6.1.0, < 6.1.29
>= 6.2.0, < 6.2.20
>= 7.0.0, < 7.0.8.1
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*
Debian:12 debian libspring-java All versions
maven – org.springframework:spring-webflux >= 5.2.5.RELEASE, <= 5.2.25.RELEASE
>= 5.3.0, <= 5.3.49
>= 6.0.0, <= 6.0.30
>= 6.1.0, <= 6.1.28
>= 6.2.0, <= 6.2.19
>= 7.0.0, <= 7.0.8
Fix: upgrade to 7.0.9
Root:Maven – org.springframework:spring-webflux < 6.1.15-aikido.2
Fix: upgrade to 6.1.15-aikido.2
Root:Maven – io.root.org.springframework:spring-webflux < 6.1.15-root.io.2
Fix: upgrade to 6.1.15-root.io.2
Original advisory text
CVE-2026-47892 in org.springframework:spring-webflux - Patched by Root
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published27 Aug 2026
Updated15 Nov 2026
First seen27 Aug 2026
Sources
CVE-2026-47892 · NVD
CVE-2026-47892 · MITRE
UBUNTU-CVE-2026-47892 · OSV
DEBIAN-CVE-2026-47892 · OSV
GHSA-9qf2-26p9-2q2q · GHSA
ROOT-APP-MAVEN-CVE-2026-47892 · OSV
Track software like this
Free during beta