Spring Framework CVE-2026-47892: Critical Header Predicate Bypass in WebFlux Functional Endpoints
Spring Framework CVE-2026-47892: Critical Header Predicate Bypass in WebFlux Functional Endpoints
On August 27, 2026, the Spring team disclosed CVE-2026-47892, a critical authorization flaw affecting the Spring Framework's WebFlux module. Rated 9.8 (Critical) on the CVSS scale and classified under CWE-863 (Incorrect Authorization), the vulnerability allows attackers to bypass header-based access controls in applications that use functional endpoints alongside a DispatcherServlet deployment. The issue stems from how pre-flight requests are handled, and it affects a wide swath of Spring Framework versions spanning from the legacy 5.2.x line all the way up to the current 7.0.x branch.
The Vulnerability
At its core, CVE-2026-47892 is a header predicate bypass. In Spring WebFlux, developers commonly use functional routing with predicates such as RequestPredicates.headers(...) to gate access to specific endpoints based on HTTP headers. These predicates are meant to act as a first line of authorization — for example, requiring a specific X-Api-Key or Authorization header before a route is matched.
The flaw arises when a WebFlux application is deployed with a DispatcherServlet and receives a pre-flight request (such as an HTTP OPTIONS request or a CORS pre-flight). Under certain conditions, the header predicate is not evaluated correctly during this pre-flight phase, allowing a request to reach the underlying handler without satisfying the intended header-based condition. In practice, this means an attacker can craft a request that skips the header check entirely, effectively bypassing the authorization logic that the predicate was supposed to enforce.
Because the vulnerability is classified as Incorrect Authorization rather than a memory-safety or injection issue, the impact is logical rather than technical: the application's own access-control rules are silently ignored. This makes the flaw particularly dangerous in API gateways, internal microservices, and any WebFlux service that relies on header predicates as a security boundary.
Why It Matters
The severity of CVE-2026-47892 is driven by three factors. First, it is automatable — the CISA SSVC assessment marks Automatable = Yes, meaning the exploit can be scripted and launched at scale without human interaction. Second, the technical impact is rated Total, indicating that a successful exploit can lead to complete compromise of the affected component's authorization model. Third, the affected version range is exceptionally broad, covering six major release lines and dozens of patch versions.
For organizations running Spring-based services, the practical consequence is that an attacker who can reach a vulnerable WebFlux endpoint may be able to invoke protected handlers without valid credentials or headers. This could expose sensitive data, allow unauthorized state changes, or grant access to administrative functionality. While the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and has not been observed being exploited in the wild as of this writing, the combination of critical severity and easy automation makes it a prime candidate for rapid weaponization.
Affected Versions
The following Spring Framework version ranges are affected:
- 7.0.0 through 7.0.8
- 6.2.0 through 6.2.19
- 6.1.0 through 6.1.28
- 6.0.0 through 6.0.30
- 5.3.0 through 5.3.49
- 5.2.5.RELEASE through 5.2.25.RELEASE
Note that the fix is available as 7.0.9 for the open-source (OSS) line. For the other affected branches, patches are currently distributed only through enterprise support channels, which means many self-managed deployments will need to plan an upgrade path or apply mitigations until a public fix is available.
What Should You Do?
- Inventory your Spring Framework usage. Identify every service running a version in the affected ranges, paying special attention to WebFlux applications that use functional endpoints and header predicates.
- Upgrade where possible. Move to Spring Framework 7.0.9 (or a patched enterprise release) as soon as it is available for your environment. Prioritize internet-facing services first.
- Audit your authorization logic. Do not rely solely on header predicates as a security boundary. Move critical authorization checks into the handler or a dedicated security layer (e.g., Spring Security) that is evaluated independently of routing predicates.
- Deploy compensating WAF rules. Configure your Web Application Firewall to detect and block anomalous pre-flight and
OPTIONSrequests targeting WebFlux endpoints, and to flag requests that reach protected routes without expected authorization headers. - Monitor for exploitation. Watch access logs for unusual
OPTIONS/pre-flight traffic patterns and for requests hitting protected endpoints without the required headers, which may indicate active probing.
The WAF Angle
While CVE-2026-47892 is fundamentally an application-layer authorization flaw, a properly configured WAF can provide meaningful defense-in-depth. Because the bypass manifests through pre-flight requests, WAF rules that inspect and normalize OPTIONS and CORS pre-flight traffic can help surface suspicious activity. More importantly, WAFs can enforce positive security models — for example, requiring that requests to known-protected WebFlux routes always carry the expected authorization headers, and blocking those that do not. This shifts the enforcement point away from the vulnerable predicate and onto an independent layer that is not affected by the framework bug.
Teams should also consider rate-limiting pre-flight requests and enabling anomaly detection on header presence/absence, since automated exploitation attempts will likely exhibit repetitive, scripted patterns. Combined with prompt patching, these WAF controls can significantly reduce the window of exposure while enterprise fixes are rolled out.
