Description

When an IntegrationFlow uses .fluxTransform() with an asynchronous/reordering fluxFunction that emits raw payloads, concurrent requests on the same FluxMessageChannel subscription have their reply headers (replyChannel, errorChannel, correlationId, any propagated security/tenant headers) copied from whichever message was most recently consumed upstream. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 Spring Integration 5.5.21 and earlier

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-27T20:17:58.500Z",
  "pubdate": "2026-08-27T20:17:58.500Z",
  "executiveSummary": "A critical header propagation vulnerability exists within Spring Integration components utilizing .fluxTransform().\nThe vulnerability manifests as an improper state management issue where asynchronous/reordering fluxFunction implementations cause cross-request header contamination.\nAffected products include Spring Integration versions 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 or earlier.\nWhen concurrent requests share a FluxMessageChannel subscription, the framework erroneously overwrites replyChannel, errorChannel, correlationId, and security-critical tenant headers with data from the most recently consumed upstream message.\nThis flaw allows for unauthorized information disclosure and request hijacking, as sensitive security context or routing headers from one user session may be injected into the response or processing flow of an unrelated concurrent request.\nSuccessful exploitation requires the presence of asynchronous flux functions that emit raw payloads, facilitating a state-coupling condition between disparate message streams.\nRisk implications include potential data breaches, unauthorized access due to tenant header confusion, and disruption of message routing integrity.",
  "technicalDetails": "The root cause of this vulnerability lies in the race condition and improper thread-local or state-binding logic within the FluxMessageChannel integration layer when processing asynchronous streams. Specifically, the .fluxTransform() operator fails to maintain strict message context isolation when a fluxFunction produces raw payloads asynchronously.\nIn a standard Spring Integration message pipeline, reply headers such as 'replyChannel', 'errorChannel', and 'correlationId' are expected to be immutable and unique to the scope of a single message exchange. However, when multiple messages flow through a reactive Flux stream concurrently, the framework's internal management of the message headers fails to ensure that these headers remain bound to their originating message once the Flux processing enters an asynchronous or reordering phase.\nThe attack flow proceeds as follows: An attacker sends a legitimate, authenticated request (Request A) into a flow containing a .fluxTransform() reactive processor. Simultaneously, a second request (Request B), potentially originating from a different user or tenant, enters the same pipeline. If the fluxFunction is configured for reordering or asynchronous processing, the underlying FluxMessageChannel subscription manages the emission of the resulting raw payloads. Due to the lack of proper context cloning or isolation, the subscription mechanism populates the response headers of Request B using the metadata stored in the shared message context, which has been overwritten by the most recently processed message (Request A).\nConsequently, the response for Request B is directed to the 'replyChannel' defined in Request A, or carries the 'correlationId' and security headers associated with Request A. If the headers contain sensitive tenant identifiers or security tokens, the downstream components will process the response of Request B using the authorization context of Request A.\nThis behavior affects several versions across the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines. The vulnerability does not require prior authentication or high privileges, as it is a direct consequence of the internal stream processing logic. The impact is significant in multi-tenant environments where header-based tenant isolation or security propagation is strictly enforced. By manipulating the timing and frequency of concurrent messages, an attacker can reliably cause the application to leak context across session boundaries, leading to incorrect routing or the exposure of data to an unauthorized destination channel."
}