Skip to content
fr Sign in
7.5 High

CVE-2026-59288 The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application

Description

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

Affected products and versions

Product Affected versions Fixed in
Spring for GraphQL 2.0 2.0.0 → 2.0.4 No fix stated
Spring for GraphQL 1.4 1.4.0 → 1.4.6 No fix stated
Spring for GraphQL 1.1 1.1.0 → 1.3.9 No fix stated
Spring for GraphQL 1.0 1.0.0 → 1.0.7 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring for GraphQL

The 9 CVEs of Spring for GraphQL →
CVE-2026-59289 Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the… 7.5 High CVE-2026-59287 Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled 5.9 Medium CVE-2026-59286 The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource… 8.1 High CVE-2026-59285 Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries 8.1 High
Track this CVE