Back Heise.De

SSL configuration error jeopardizes VMware Tanzu Spring Cloud Gateway

Heise.De • April 13, 2026

Due to an error, certain SSL configurations in the VMware Tanzu Spring Cloud Gateway API gateway are not applied – users are unaware of this. A patch now resolves the issue.

In a warning message, the developers explain that errors can occur when configuring SSL bundles using spring.ssl.bundle . This leads to settings being ignored and the default SSL configuration being used instead.

If administrators make individual, security-relevant changes that are then not applied, this creates a security risk.

The developers state that they have closed the vulnerability (CVE-2026-22750, “ high ”) in Spring Cloud Gateway 4.2.1 (Enterprise Support Only) . So far, there are no indications of attacks.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-22750: SSL Configuration Error in Spring Cloud Gateway A vulnerability (CVE-2026-22750) was identified in VMware Tanzu Spring Cloud Gateway, where SSL configurations using the property spring.ssl.bundle were ignored, leading to the use of default SSL settings. This issue affects users of Spring Cloud Gateway 4.2.0 and earlier versions, potentially compromising security if administrators make critical changes that are not applied. The vulnerability was reported by Otmane Omry and has been classified as 'high' severity. A patch has been released in version 4.2.1, but it is only available to enterprise customers. Users are advised to upgrade to supported versions 5.0.2 or 5.1.1. No active exploitation has been reported as of now. The vulnerability was published on April 10, 2026. 1 sources 58

Extracted Entities

CVEs (1)

CVE-2026-22750

Platforms (1)

VMware Tanzu Spring Cloud Gateway