Spring Cloud Gateway fixes silent SSL bundle bypass

TL;DR — A High-severity Spring Cloud Gateway bug can silently ignore spring.ssl.bundle and fall back to default SSL configuration, undermining intended TLS posture without obvious failure signals.

What happened

Spring Cloud Gateway is Spring’s API gateway for routing and filtering traffic in JVM microservice environments.

Spring’s advisory for CVE-2026-22750 states that when SSL bundles are configured via the spring.ssl.bundle property, that configuration can be silently ignored, and Spring Cloud Gateway instead uses the default SSL configuration. This is a sharp edge for platform teams because it can create a “looks configured” state in config-as-code while the runtime TLS settings differ from what operators intended.

Misconfiguration-bypass issues that fail “quietly” are operationally dangerous: they’re likely to slip through reviews, and they often surface only after an incident or an audit when TLS identity and trust assumptions are tested.

Who is impacted

• Deployments using Spring Cloud Gateway 4.2.0.
• Environments relying on SSL bundle configuration via spring.ssl.bundle (for example, teams expecting a specific key/cert, truststore, or bundle selection to be enforced at the gateway).
• Higher-risk gateways where TLS settings are part of an authorization boundary (mTLS, internal PKI enforcement, or strict truststore constraints), since a fallback to defaults can invalidate those assumptions.

What to do now

• Follow vendor remediation guidance.

  "Users of affected versions should upgrade to the corresponding fixed version."

• If you are on 4.2.0, use the advisory’s guidance on fix options and support status:
  • The advisory lists 4.2.1 (or newer releases) as the fix for 4.2.0, and marks availability as enterprise-only.
  • The advisory also notes the 4.2.x branch is no longer under open source support and suggests upgrading to supported open source releases (5.0.2 or 5.1.1).
• Confirm runtime behavior, not just configuration intent:
  • Add an automated check (integration test or startup validation) that inspects the effective TLS material and verifies the expected certificate chain / trust configuration is actually in use.
  • Audit running gateway artifacts and configuration repos for uses of spring.ssl.bundle so you can scope exposure quickly.