CVE-2026-47892 in Spring Framework
Summary
by MITRE • 08/27/2026
A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.5.RELEASE - 5.2.25.RELEASE
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
A critical security vulnerability has been identified in the Spring WebFlux framework, specifically affecting applications that utilize functional endpoints and are deployed with a DispatcherServlet. This flaw manifests as a header predicate bypass during HTTP pre-flight requests, which are part of the Cross-Origin Resource Sharing (CORS) mechanism used by browsers to validate cross-origin API calls before sending actual data payloads. The vulnerability impacts multiple versions of the Spring Framework, including 7.0 through 5.2.25.RELEASE, indicating a widespread exposure across legacy and current enterprise systems that rely on this specific configuration pattern for handling asynchronous web requests.
The technical root cause lies in how the framework processes CORS pre-flight OPTIONS requests when functional endpoints are involved. In standard Spring MVC applications using traditional controller-based routing, the security filters correctly validate headers against defined predicates to ensure only authorized origins can access protected resources. However, in WebFlux environments configured with functional endpoints and a DispatcherServlet adapter, the request handling pipeline fails to properly apply header validation logic during the pre-flight phase. This allows an attacker to craft malicious OPTIONS requests that bypass origin checks or other header-based security constraints designed to prevent unauthorized cross-origin interactions.
The operational impact of this vulnerability is significant for any application exposing sensitive APIs via CORS. An attacker can exploit this flaw to perform Cross-Site Request Forgery (CSRF) attacks against authenticated users, as the browser will allow the pre-flight request to proceed without triggering standard security blocks. This enables the exfiltration of sensitive data or the execution of unauthorized actions on behalf of a victim who is logged into the vulnerable application. Since pre-flight requests are often less strictly monitored than actual POST or PUT requests, this bypass provides an effective vector for initial reconnaissance and subsequent exploitation in environments where CORS policies were assumed to be fully enforced by the framework's default settings.
This vulnerability aligns with CWE-346, which describes the issue of Origin Validation Errors, specifically where validation is performed incorrectly allowing unauthorized access. It also maps to MITRE ATT&CK technique T1505.003, Server Side Web Framework Component, as it exploits a misconfiguration or flaw within the web framework's component responsible for handling HTTP requests and security policies. The bypass effectively undermines the Same-Origin Policy, which is fundamental to browser-based application security, thereby exposing applications to risks associated with unauthorized data access and state manipulation.
Mitigation requires upgrading the Spring Framework to versions that include patches for this specific header predicate logic in WebFlux functional endpoint scenarios. For organizations unable to immediately upgrade due to compatibility constraints, implementing additional server-side validation layers or custom CORS filters can provide temporary protection by explicitly checking origin headers before processing any request, regardless of whether it is a pre-flight or actual data request. Developers should also review their application configurations to ensure that no legacy DispatcherServlet adapters are being used with WebFlux functional endpoints unless absolutely necessary, as this combination appears to be the primary vector for exploitation. Regular security audits and static code analysis tools configured to detect improper CORS implementations can help identify similar misconfigurations in other parts of the application stack before they are exploited by malicious actors seeking to bypass authentication or authorization controls.