7.5
High
CVE-2026-41856 The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on…
Description
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring for GraphQL 2.0 | 2.0.0 → < 2.0.3.1 | 2.0.3.1 |
| Spring for GraphQL 1.4 | 1.4.0 → < 1.4.5.1 | 1.4.5.1 |
| Spring for GraphQL 1.3 | 1.3.0 → < 1.3.9 | 1.3.9 |
| Spring for GraphQL 1.0 | 1.0.0 → < 1.0.7 | 1.0.7 |
References
- spring.io spring.io
Timeline
- Published
- Last modified
Other CVEs of Spring for GraphQL
The 9 CVEs of Spring for GraphQL →
CVE-2026-59289
Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the…
7.5
High
CVE-2026-59288
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application
7.5
High
CVE-2026-59287
Spring for GraphQL is vulnerable to Denial of Service attacks when using the WebSocket client with keepAlive enabled
5.9
Medium
CVE-2026-59286
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource…
8.1
High