What’s Vulnerable › Vulnerabilities

CVE-2026-41856: Spring GraphQL Annotation Detection Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-11 · updated 2026-07-23
• Weakness: CWE-284

Description

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Affected products

• Spring for GraphQL: from 1.0.0 before 1.0.7; from 1.3.0 before 1.3.9; from 1.4.0 before 1.4.5.1; from 2.0.0 before 2.0.3.1 — fixed in 1.0.7, 1.3.9, 1.4.5.1, 2.0.3.1
• Spring for GraphQL: from 2.0.0 before 2.0.3.1; from 1.4.0 before 1.4.5.1; from 1.3.0 before 1.3.9; from 1.0.0 before 1.0.7 — fixed in 2.0.3.1, 1.4.5.1, 1.3.9, 1.0.7

How to fix

Upgrade to a fixed version: Spring for GraphQL 1.0.7, 1.3.9, 1.4.5.1, 2.0.3.1; Spring for GraphQL 2.0.3.1, 1.4.5.1, 1.3.9, 1.0.7. Check the vendor advisory for mitigations.

References

• https://spring.io/security/cve-2026-41856

Get alerted when CVE-2026-41856 or the next vulnerability affects your stack