CVE-2026-41847: Spring WebFlux Kotlin Router DSL Security Bypass (CVSS 4.8)

Technical summary

This vulnerability is rooted in improper access control enforcement (CWE-284) within Spring WebFlux's Kotlin Router DSL implementation. When applications define routes using this DSL, certain security checks may be bypassed under specific conditions, potentially allowing unauthorized access to protected resources. The attack vector is network-based with high complexity, meaning an attacker must craft conditions carefully to trigger the bypass, but no authentication is required and no user interaction is necessary.

Business impact

Organizations running Spring WebFlux with Kotlin Router DSL could face unauthorized data disclosure or modification of application state, depending on what resources are exposed by the affected routes. The impact is limited to confidentiality and integrity; availability is not compromised. Teams operating microservices or reactive APIs built on vulnerable Spring Framework versions should evaluate whether this configuration is in use and whether exposed endpoints handle sensitive data or operations.

Affected systems

VMware Spring Framework versions 5.3.0 through 5.3.48 are affected when used with the Kotlin Router DSL feature in Spring WebFlux. This primarily impacts Java applications that have explicitly adopted the Kotlin-based routing API for reactive request handling. Applications using traditional Spring MVC or Java-based Router DSL are not affected by this specific issue.

Exploitability

While the CVSS vector indicates high attack complexity (AC:H), suggesting exploitation requires specific preconditions, this vulnerability does not appear on the KEV catalog as of now, indicating either limited in-the-wild exploitation or insufficient public proof-of-concept details. Attackers would need detailed knowledge of the target application's Kotlin Router DSL configuration to reliably exploit the bypass, but the network-accessible nature and lack of authentication requirement mean opportunistic scanning could identify vulnerable endpoints.

Remediation

Upgrade Spring Framework to a version beyond 5.3.48. Verify the exact patched version against VMware's official security advisory before deployment. In the interim, review your Kotlin Router DSL route definitions for sensitive endpoints and consider applying additional security layers such as API gateway authentication, request filtering, or role-based access control middleware independent of the router configuration.

Patch guidance

Consult VMware's official Spring Framework security advisory for the specific patched version number and availability timeline. Test the upgrade in a staging environment thoroughly, as Spring Framework updates may introduce compatibility changes. If you maintain a custom fork or extension of Spring, ensure any overrides to the Kotlin Router DSL are also reviewed for similar access control issues.

Detection guidance

Monitor application logs for unexpected access patterns to endpoints defined via Kotlin Router DSL, particularly unusual request paths or parameter combinations that might indicate bypass attempts. Review your Spring Framework version in runtime and build artifacts using dependency scanning tools. If you have detailed request logs, look for patterns where authentication or authorization headers are missing or malformed yet requests still succeed, which may indicate the bypass is being triggered.

Why prioritize this

Although rated MEDIUM severity, this vulnerability should be prioritized based on your application's reliance on Kotlin Router DSL for security-sensitive endpoints. If you do not use this specific DSL feature, the risk is effectively zero. For those who do, the ability to bypass access controls—even with high exploitation complexity—warrants prompt patching, especially if the affected routes expose user data, modify system state, or integrate with sensitive business logic.

Risk score, explained

The CVSS 3.1 score of 4.8 reflects a network-accessible bypass (AV:N) with high attack complexity (AC:H), limited impact on confidentiality and integrity (C:L, I:L), and no availability impact (A:N). The high complexity factor acknowledges that successful exploitation requires specific preconditions, likely related to how routes are configured or which request patterns are sent. The network vector and lack of authentication requirement prevent a lower score despite the complexity barrier.

Frequently asked questions