CVE-2026-41856
Spring GraphQL Annotation Detection Vulnerability
CVE-2026-41856 is a high vulnerability (CVSS 7.5) in Spring For Graphql, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 28th percentile. Fixed in org.springframework.graphql:spring-graphql 2.0.4.
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Spring GraphQL Annotation Detection Vulnerability
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
CVE-2026-41856- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2026-36214
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
EUVD-2026-36214- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-phxq-526m-79px
Spring for GraphQL: Annotation Detection Vulnerability
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
GHSA-phxq-526m-79px- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
NVD
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
CVE-2026-41856- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Spring GraphQL Annotation Detection Vulnerability
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
CVE-2026-41856- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-phxq-526m-79px
Spring for GraphQL: Annotation Detection Vulnerability
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
- Record
GHSA-phxq-526m-79px- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
Show 8 moreShow less
OSVCLSA-2026-1786693842 No score
TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (6 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1786693842- Updated
- 2026-11-02
OSVCLSA-2026-1789149911 No score
TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.3.5-tuxcare.4.
- Record
CLSA-2026-1789149911- Updated
- 2026-11-02
OSVCLSA-2026-1789150088 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1789150088- Updated
- 2026-11-02
OSVCLSA-2026-1789369685 No score
TuxCare security update for org.springframework.graphql:spring-graphql (1 CVE)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 1 CVE. Fixed in 1.2.9-tuxcare.6.
- Record
CLSA-2026-1789369685- Updated
- 2026-11-02
OSVCLSA-2026-1789373257 No score
TuxCare security update for org.springframework.graphql:spring-graphql (4 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 4 CVEs. Fixed in 1.0.6-tuxcare.6.
- Record
CLSA-2026-1789373257- Updated
- 2026-11-02
OSVCLSA-2026-1789710059 No score
TuxCare security update for org.springframework.graphql:spring-graphql (2 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 2 CVEs. Fixed in 1.1.7-tuxcare.1.
- Record
CLSA-2026-1789710059- Updated
- 2026-11-02
OSVCLSA-2026-1791826672 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.2.4-tuxcare.1.
- Record
CLSA-2026-1791826672- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-41856 No score
CVE-2026-41856 in org.springframework.graphql:spring-graphql - Patched by Root
Root has patched CVE-2026-41856 in the org.springframework.graphql:spring-graphql package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-41856- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.graphql:spring-graphqlMaven |
2.0.0 to 2.0.3 | 2.0.4 |
org.springframework.graphql:spring-graphqlMaven |
1.4.0 to 1.4.5 | 1.4.6 |
org.springframework.graphql:spring-graphqlMaven |
1.3.0 to 1.3.8 | None known |
org.springframework.graphql:spring-graphqlMaven |
1.0.0 to 1.0.6 | None known |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.3.5 up to 1.3.5-tuxcare.4, plus listed versions 1.3.5-tuxcare.11.3.5-tuxcare.21.3.5-tuxcare.3 |
1.3.5-tuxcare.4 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.3.7 up to 1.3.7-tuxcare.4, plus listed versions 1.3.7-tuxcare.11.3.7-tuxcare.21.3.7-tuxcare.3 |
1.3.7-tuxcare.4 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.2.9 up to 1.2.9-tuxcare.6, plus listed versions 1.2.9-tuxcare.11.2.9-tuxcare.21.2.9-tuxcare.31.2.9-tuxcare.41.2.9-tuxcare.5 |
1.2.9-tuxcare.6 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.0.6 up to 1.0.6-tuxcare.6, plus listed versions 1.0.6-tuxcare.21.0.6-tuxcare.31.0.6-tuxcare.41.0.6-tuxcare.51.0.6.tuxcare.1 |
1.0.6-tuxcare.6 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.1.7 up to 1.1.7-tuxcare.1 | 1.1.7-tuxcare.1 |
org.springframework.graphql:spring-graphqlTuxCare:Maven |
1.2.4 up to 1.2.4-tuxcare.1 | 1.2.4-tuxcare.1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.graphql:spring-graphqlMaven |
2.0.0 up to 2.0.4, plus listed versions 2.0.12.0.22.0.3 |
2.0.4 |
org.springframework.graphql:spring-graphqlMaven |
1.4.0 up to 1.4.6, plus listed versions 1.4.11.4.21.4.31.4.41.4.5 |
1.4.6 |
org.springframework.graphql:spring-graphqlMaven |
1.3.0 to 1.3.8, plus listed versions 1.3.11.3.21.3.31.3.41.3.51.3.61.3.7 |
None known |
org.springframework.graphql:spring-graphqlMaven |
1.0.0 to 1.0.6, plus listed versions 1.0.11.0.21.0.31.0.41.0.5 |
None known |
org.springframework.graphql:spring-graphqlRoot:Maven |
before 1.3.3-aikido.1 | 1.3.3-aikido.12.0.3-aikido.12.0.2-aikido.11.4.5-aikido.1 |
io.root.org.springframework.graphql:spring-graphqlRoot:Maven |
before 1.3.3-root.io.1 | 1.3.3-root.io.12.0.3-root.io.12.0.2-root.io.11.4.5-root.io.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-02 | affected | OSV |
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
spring.io/security/cve-2026-41856
nvd.nist.gov/vuln/detail/CVE-2026-41856
github.com/spring-projects/spring-graphql/commit/63a89ed1379be646822dca9779b15dbf2ce45839