Vulnerability · Published Jun 11, 2026 · Assigned by vmware
CVE-2026-41856Spring GraphQL Annotation Detection Vulnerability
High 7.5
In plain English
A high-severity improper access control in Spring for GraphQL from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.graphql:spring-graphql | 2.0.4 | GHSA-phxq-526m-79px |
| Maven | org.springframework.graphql:spring-graphql | 1.4.6 | GHSA-phxq-526m-79px |
| Maven | org.springframework.graphql:spring-graphql | no fix listed | GHSA-phxq-526m-79px |
| Maven | org.springframework.graphql:spring-graphql | no fix listed | GHSA-phxq-526m-79px |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring for GraphQL | 2.0.0 – before 2.0.3.11.4.0 – before 1.4.5.11.3.0 – before 1.3.91.0.0 – before 1.0.7 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N