Breaking Nimbus: from header confusion to unauthenticated RCE

A parser differential between the edge proxy and the origin let a crafted Transfer-Encoding chain smuggle admin routes.

#request-smuggling

#rce

#cve-2025-41822

The finding

Nimbus API Gateway sits behind an edge proxy that terminates TLS and forwards requests to an origin service. Both layers parse the same HTTP request, but they disagreed about where it ended. That disagreement is the whole bug.

The edge treated part of the message as a body. The origin treated it as the start of a new request. Routes that were blocked at the edge were reachable from the origin side, with none of the authentication the edge normally enforces.

Impact

An unauthenticated client could reach internal admin routes. One of them accepted plugin configuration, which raised the severity to remote code execution and earned the 9.8 CVSS score.

The fix

The vendor now rejects ambiguous framing at the edge and normalises headers before forwarding. Disclosure followed the standard 90-day window, and every customer had a patched build before this post went live.