CVE-2026-41700
Cross-Site WebSocket Hijacking in Spring for GraphQL
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-Site WebSocket Hijacking in Spring for GraphQL
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
CVE-2026-41700- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
EUVDEUVD-2026-36213
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
EUVD-2026-36213- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m39w-hqxx-3r48
Spring for GraphQL: Cross-Site WebSocket Hijacking
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
GHSA-m39w-hqxx-3r48- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
CVE-2026-41700- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSV
Cross-Site WebSocket Hijacking in Spring for GraphQL
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
CVE-2026-41700- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
OSVGHSA-m39w-hqxx-3r48
Spring for GraphQL: Cross-Site WebSocket Hijacking
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
GHSA-m39w-hqxx-3r48- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
Show 8 moreShow less
OSVCLSA-2026-1786693842 No score
TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (6 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1786693842- Updated
- 2026-11-02
OSVCLSA-2026-1788870312 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.3.5-tuxcare.3.
- Record
CLSA-2026-1788870312- Updated
- 2026-11-02
OSVCLSA-2026-1788873403 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.2.9-tuxcare.5.
- Record
CLSA-2026-1788873403- Updated
- 2026-11-02
OSVCLSA-2026-1789150088 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1789150088- Updated
- 2026-11-02
OSVCLSA-2026-1789373257 No score
TuxCare security update for org.springframework.graphql:spring-graphql (4 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 4 CVEs. Fixed in 1.0.6-tuxcare.6.
- Record
CLSA-2026-1789373257- Updated
- 2026-11-02
OSVCLSA-2026-1791823173 No score
TuxCare security update for org.springframework.graphql:spring-graphql (2 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 2 CVEs. Fixed in 1.1.7-tuxcare.2.
- Record
CLSA-2026-1791823173- Updated
- 2026-11-02
OSVCLSA-2026-1791826672 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.2.4-tuxcare.1.
- Record
CLSA-2026-1791826672- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-41700 No score
CVE-2026-41700 in org.springframework.graphql:spring-graphql - Patched by Root
Root has patched CVE-2026-41700 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41700- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.graphql:spring-graphqlMaven |
2.0.0 to 2.0.3 | 2.0.4 |
org.springframework.graphql:spring-graphqlMaven |
1.4.0 to 1.4.5 | 1.4.6 |
org.springframework.graphql:spring-graphqlMaven |
1.3.0 to 1.3.8 | None known |
org.springframework.graphql:spring-graphqlMaven |
1.0.0 to 1.0.6 | None known |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.3.5 up to 1.3.5-tuxcare.3, plus listed versions 1.3.5-tuxcare.11.3.5-tuxcare.2 |
1.3.5-tuxcare.3 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.2.9 up to 1.2.9-tuxcare.5, plus listed versions 1.2.9-tuxcare.11.2.9-tuxcare.21.2.9-tuxcare.31.2.9-tuxcare.4 |
1.2.9-tuxcare.5 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.3.7 up to 1.3.7-tuxcare.4, plus listed versions 1.3.7-tuxcare.11.3.7-tuxcare.21.3.7-tuxcare.3 |
1.3.7-tuxcare.4 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.0.6 up to 1.0.6-tuxcare.6, plus listed versions 1.0.6-tuxcare.21.0.6-tuxcare.31.0.6-tuxcare.41.0.6-tuxcare.51.0.6.tuxcare.1 |
1.0.6-tuxcare.6 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.1.7 up to 1.1.7-tuxcare.2, plus listed versions 1.1.7-tuxcare.1 |
1.1.7-tuxcare.2 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.2.4 up to 1.2.4-tuxcare.1 | 1.2.4-tuxcare.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.graphql:spring-graphqlMaven |
2.0.0 up to 2.0.4, plus listed versions 2.0.12.0.22.0.3 |
2.0.4 |
org.springframework.graphql:spring-graphqlMaven |
1.4.0 up to 1.4.6, plus listed versions 1.4.11.4.21.4.31.4.41.4.5 |
1.4.6 |
org.springframework.graphql:spring-graphqlMaven |
1.3.0 to 1.3.8, plus listed versions 1.3.11.3.21.3.31.3.41.3.51.3.61.3.7 |
None known |
org.springframework.graphql:spring-graphqlMaven |
1.0.0 to 1.0.6, plus listed versions 1.0.11.0.21.0.31.0.41.0.5 |
None known |
org.springframework.graphql:spring-graphqlRoot:Maven |
before 1.3.3-aikido.1 | 1.3.3-aikido.12.0.3-aikido.12.0.2-aikido.11.4.5-aikido.1 |
io.root.org.springframework.graphql:spring-graphqlRoot:Maven |
before 1.3.3-root.io.1 | 1.3.3-root.io.12.0.3-root.io.12.0.2-root.io.11.4.5-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41700 is a high vulnerability (CVSS 8.1) in Spring For Graphql, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in org.springframework.graphql:spring-graphql 2.0.4.
References
spring.io/security/cve-2026-41700
nvd.nist.gov/vuln/detail/CVE-2026-41700
github.com/spring-projects/spring-graphql/commit/3ebad2713f52e04e6dc892b5adb79a29e14f4a1a