CVE-2026-47892

A flaw was found in Spring Framework. This vulnerability allows a header predicate bypass to occur in a pre-flight request within a WebFlux application that uses functional endpoints and is deployed with DispatcherServlet. This bypass could potentially lead to unexpected behavior or security policy circumvention.

This vulnerability is rated as Moderate impact because successful exploitation depends on a specific application architecture combining WebFlux functional routing with a traditional servlet-based DispatcherServlet container. The issue only affects header predicate validation during CORS pre-flight transactions, limiting the impact to potential routing misdirection or unauthorized request matching rather than arbitrary code execution or direct compromise. Deployments that do not mix WebFlux functional endpoints into servlet dispatchers remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Applications should avoid relying solely on header-based route predicates (headers(...)) in WebFlux functional endpoint configurations to enforce security-relevant access control, since this bypass allows such guards to be circumvented via a crafted CORS pre-flight request. Combining header predicates with a dedicated authentication/authorization layer (e.g., Spring Security) prevents exploitation of this specific issue.

For Red Hat Fuse 7, which is in Extended Life Support Phase 2 and will not receive a fix for this issue, this configuration- based guidance is the only available mitigation.