Trusted upstream forwarded headers are dropped when forwarded filter is disabled

Describe the bug

In version 2025.1.2 / 2025.0.3 a new filter was added to remove existing forwarded headers when the gateway does not have forwarding support enabled, or does not trust upstream proxies. However this broke my k8s setup:

• an edge api gateway which adds forwarded headers
• a second gateway, downstream from edge, which is used to route requests to different containers in the same pod
• a container in the same pod as the internal gateway

In this setup the internal gateway does not add forwarded headers, as they would only refer to internal resources, and they are not relevant. It, however, trusts the upstream edge gateway.

In previous versions this worked as expected, but it broke with the last update.

Is this behavior intended (perhaps as part of CVE-2026-47825)? If so, what is the correct way to support use cases like mine?

Sample

https://github.com/gbaso/spring-cloud-gateway-forwarded

Reproduce the reported Kubernetes topology using the sample project at https://github.com/gbaso/spring-cloud-gateway-forwarded and compare behavior across the affected versions. Start by tracing the forwarded-header filter and its trust configuration; done means the handling of trusted upstream headers is verified and covered for this setup.