The vulnerability stems from the implementation of the isSecure() method in ServerlessHttpServletRequest, which fails to validate the actual URI scheme. As a result, applications using Spring Cloud Function may incorrectly treat non‑secure (HTTP) connections as secure (HTTPS). This flaw does not grant direct code execution or data theft on its own, but it can undermine security controls that depend on accurate scheme verification, potentially enabling attackers to bypass authentication or encryption checks. The weakness is a form of improper authorization, classified as CWE‑285.

Spring Cloud Function versions 5.0.0 through 5.0.3, 4.3.0 through 4.3.4, and 4.2.0 through 4.2.7 are affected.

The CVSS score is 3.1, indicating low severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. Because the issue only misreports the scheme, it does not create an immediate remote code execution vector; however, it can be exploited in environments where security decisions rely on isSecure(), leading to potential privilege escalation or data exposure.