CVE-2026-41700
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Cross-Site WebSocket Hijacking vulnerability in Spring for GraphQL with WebSocket transport enabled. An attacker can trick an authenticated user into visiting a malicious page, allowing arbitrary GraphQL operations with the victim's credentials.
Risk Assessment
Data disclosure or modification, unauthorized GraphQL operations with the victim's privileges.
Recommendation
Update Spring for GraphQL to version 2.0.4, 1.4.6, 1.3.9, or 1.0.7 depending on the used line.
Other vulnerabilities in Spring for GraphQL
See all- CVE-2026-59289Low risk· EPSS 5%
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-supplied values to the underlying repository. An attacker can forge a malicious query for a Connection field that can exhaust application memory or place significant, prolonged load on the underlying datastore, resulting in a Denial of Service. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.2.0-1.3.9.
- CVE-2026-59288Low risk· EPSS 4%
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, 1.1.0-1.3.9, and 1.0.0-1.0.7.
- CVE-2026-59287Low risk· EPSS 4%
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, and 1.3.0-1.3.9.
- CVE-2026-59286Low risk· EPSS 2%
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Affects Spring for GraphQL versions 2.0.0-2.0.4, 1.4.0-1.4.6, 1.1.0-1.3.9, and 1.0.0-1.0.7.
- CVE-2026-59285Low risk· EPSS 36%
Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Affects versions 2.0.0 - 2.0.4.
- CVE-2026-41856High
Vulnerability in Spring GraphQL causes the @Controller annotation detection mechanism to incorrectly resolve annotations in type hierarchies. This can lead to security annotations being ignored at runtime.
- CVE-2026-41699High
Spring for GraphQL is vulnerable to unsafe deserialization when processing paginated GraphQL queries. An attacker can craft a malicious request leading to Remote Code Execution (RCE) if the application exposes a Connection field and the classpath contains specific classes.
Original NVD description (English source)
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.