CVE-2026-22750

OVERVIEW CVE-2026-22750 affects Spring Cloud Gateway versions, specifically impacting the SSL bundle configuration mechanism. When administrators configure SSL bundles using the spring.ssl.bundle configuration property, the settings are silently ignored and the application defaults to the standard SSL configuration instead. This configuration bypass vulnerability creates potential security misalignment between intended and actual SSL/TLS implementations. SEVERITY The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH), with a network-based attack vector requiring no privileges or user interaction. The primary impact is integrity-based, as the ignored SSL configuration could lead to unexpected TLS implementations that do not match security policies. The attack complexity is low, making exploitation straightforward for threat actors who can trigger the vulnerable code path through normal network operations. EXPLOITATION STATUS There is no evidence of active exploitation, with no inclusion on the Known Exploited Vulnerabilities (KEV) catalog and inactive status on security hot lists. The EPSS score of 0.00045 indicates very low probability of exploitation in the wild, placing it below the 0.137% threshold of all CVEs. No public exploit code appears readily available, and community attention remains minimal given the configuration-specific nature of the flaw.