CVE-2026-41856 Spring GraphQL Annotation Detection Vulnerability
Attackers can bypass authorization checks in Spring GraphQL applications if security annotations are placed on inherited methods, potentially accessing unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41856?
CVE-2026-41856 is a high-severity missing authorization vulnerability in Spring for GraphQL, published on 11 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Weakness: CWE-284
Which versions are affected by CVE-2026-41856?
8 open source packages ship an affected version, including org.springframework.graphql:spring-graphql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.graphql:spring-graphql Maven | From 1.0.0 to 1.0.6 | None |
org.springframework.graphql:spring-graphql Maven | From 1.0.0 to 1.0.6 | None |
org.springframework.graphql:spring-graphql Maven | From 1.3.0 to 1.3.8 | None |
org.springframework.graphql:spring-graphql Maven | From 1.3.0 to 1.3.8 | None |
org.springframework.graphql:spring-graphql Maven | From 1.4.0 | 1.4.6 |
org.springframework.graphql:spring-graphql Maven | From 1.4.0 | 1.4.6 |
2 more packages
org.springframework.graphql:spring-graphql Maven | From 2.0.0 | 2.0.4 |
org.springframework.graphql:spring-graphql Maven | From 2.0.0 | 2.0.4 |
Products include Vmware Spring for Graphql.
How do I fix CVE-2026-41856?
Upgrade org.springframework.graphql:spring-graphql to a fixed version for your release line: 1.4.6 or 2.0.4.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-41856 being exploited?
There is no known exploitation of CVE-2026-41856 in the wild and no public exploit code.
Other vulnerabilities in Spring for GraphQL
- CVE-2026-59285 Spring for GraphQL Unsafe Deserialization in pagination support
- CVE-2026-59286 Spring for GraphQL loads Untrusted Resources in GraphiQL support
- CVE-2026-41699 Unsafe Deserialization in Spring GraphQL
- CVE-2026-41700 Cross-Site WebSocket Hijacking in Spring for GraphQL
- CVE-2026-59288 Spring for GraphQL Information Exposure in GraphiQL support
Sources
Also known as CLSA-2026-1789149911, CLSA-2026-1789369685, GHSA-phxq-526m-79px, ROOT-APP-MAVEN-CVE-2026-41856.