What’s Vulnerable › Vulnerabilities

CVE-2026-41700: Cross-Site WebSocket Hijacking in Spring for GraphQL

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-11 · updated 2026-07-23
• Weakness: CWE-346

Description

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Affected products

• Spring for GraphQL: from 1.0.0 before 1.0.7; from 1.3.0 before 1.3.9; from 1.4.0 before 1.4.5.1; from 2.0.0 before 2.0.3.1 — fixed in 1.0.7, 1.3.9, 1.4.5.1, 2.0.3.1
• Spring for GraphQL: from 2.0.0 before 2.0.3.1; from 1.4.0 before 1.4.5.1; from 1.3.0 before 1.3.9; from 1.0.0 before 1.0.7 — fixed in 2.0.3.1, 1.4.5.1, 1.3.9, 1.0.7

How to fix

Upgrade to a fixed version: Spring for GraphQL 1.0.7, 1.3.9, 1.4.5.1, 2.0.3.1; Spring for GraphQL 2.0.3.1, 1.4.5.1, 1.3.9, 1.0.7. Check the vendor advisory for mitigations.

References

• https://spring.io/security/cve-2026-41700

Get alerted when CVE-2026-41700 or the next vulnerability affects your stack