Critical Spring Cloud Gateway Vulnerabilities (CVE-2022-22946 & 22947) – Risks and Fixes

Spring Cloud Gateway Vulnerabilities Overview

On March 1, 2022 the Spring team announced two high‑severity CVEs for Spring Cloud Gateway: CVE‑2022‑22947 (remote code execution) and CVE‑2022‑22946 (insecure HTTP/2 TrustManager).

Vulnerability 1 – Remote Code Execution (CVE‑2022‑22947)

If a Spring Cloud Gateway application exposes the Gateway Actuator endpoint, an attacker can exploit a SpEL injection to execute arbitrary code on the host.

Pre‑conditions:

The application uses Spring Boot Actuator and exposes the /actuator/gateway endpoint.

The configuration includes:

# Default true
management.endpoint.gateway.enabled=true

# Comma‑separated list of exposed endpoints (default includes health)
# Including "gateway" exposes the Gateway actuator endpoint
management.endpoints.web.exposure.include=gateway

Affected versions:

Spring Cloud Gateway 3.1.x < 3.1.1

Spring Cloud Gateway 3.0.x < 3.0.7

Other older, unsupported versions

Mitigation:

Upgrade to Spring Cloud Gateway 3.1.1 or 3.0.7.

Or disable the Gateway actuator endpoint by setting:

management.endpoint.gateway.enabled=false

Vulnerability 2 – Insecure TrustManager (CVE‑2022‑22946)

When HTTP/2 is enabled without configuring a keystore or trusted certificates, Spring Cloud Gateway uses an insecure TrustManager, allowing connections to remote services with invalid or custom certificates.

Affected version: Spring Cloud Gateway 3.1.0.

Mitigation: Upgrade to Spring Cloud Gateway 3.1.1 or later.

References:

https://tanzu.vmware.com/security/cve-2022-22946

https://tanzu.vmware.com/security/cve-2022-22947