CVE-2026-41700 Cross-Site WebSocket Hijacking in Spring for GraphQL
Attackers can hijack WebSocket connections to execute arbitrary GraphQL operations using an authenticated user's credentials in Spring for GraphQL applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41700?
CVE-2026-41700 is a high-severity vulnerability in Spring for GraphQL, published on 11 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Weakness: CWE-346
Which versions are affected by CVE-2026-41700?
8 open source packages ship an affected version, including org.springframework.graphql:spring-graphql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.graphql:spring-graphql Maven | From 1.0.0 to 1.0.6 | None |
org.springframework.graphql:spring-graphql Maven | From 1.0.0 to 1.0.6 | None |
org.springframework.graphql:spring-graphql Maven | From 1.3.0 to 1.3.8 | None |
org.springframework.graphql:spring-graphql Maven | From 1.3.0 to 1.3.8 | None |
org.springframework.graphql:spring-graphql Maven | From 1.4.0 | 1.4.6 |
org.springframework.graphql:spring-graphql Maven | From 1.4.0 | 1.4.6 |
2 more packages
org.springframework.graphql:spring-graphql Maven | From 2.0.0 | 2.0.4 |
org.springframework.graphql:spring-graphql Maven | From 2.0.0 | 2.0.4 |
Products include Vmware Spring for Graphql.
How do I fix CVE-2026-41700?
Upgrade org.springframework.graphql:spring-graphql to a fixed version for your release line: 1.4.6 or 2.0.4.
Is CVE-2026-41700 being exploited?
There is no known exploitation of CVE-2026-41700 in the wild and no public exploit code.
Other vulnerabilities in Spring for GraphQL
- CVE-2026-59285 Spring for GraphQL Unsafe Deserialization in pagination support
- CVE-2026-59286 Spring for GraphQL loads Untrusted Resources in GraphiQL support
- CVE-2026-41699 Unsafe Deserialization in Spring GraphQL
- CVE-2026-59288 Spring for GraphQL Information Exposure in GraphiQL support
- CVE-2026-59289 Spring for GraphQL Denial of Service via pagination support
Sources
Also known as GHSA-m39w-hqxx-3r48, ROOT-APP-MAVEN-CVE-2026-41700.