The vulnerability occurs when the configuration property used to specify SSL bundles in Spring Cloud Gateway is silently ignored, causing the gateway to fall back to its default SSL settings. This misconfiguration means that administrators cannot enforce the intended TLS certificates, key stores, or protocol restrictions. As a result, the gateway may operate with weaker or default TLS settings, potentially exposing traffic to downgrade or man‑in‑the‑middle attacks and bypassing intended authentication or encryption policies.

This issue affects VMware Spring Cloud Gateway, specifically versions within the 4.2.x branch and the 5.x releases that support the spring.ssl.bundle property. Users of the unsupported 4.2.0 release are particularly at risk if they believe their custom SSL bundle is active.

The CVSS score of 7.5 categorizes the problem as medium to high severity. Although EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, the fact that the configuration is silently ignored makes it exploitable by any party able to influence the gateway’s application configuration or by attackers who rely on the default, potentially insecure, TLS settings. The risk is therefore significant for deployments that depend on the gateway to enforce strict SSL policies.