CVE-2026-59286
Spring for GraphQL loads Untrusted Resources in GraphiQL support
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
- Record
CVE-2026-59286- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-494
- Updated
- 2026-11-02
CVE List
Spring for GraphQL loads Untrusted Resources in GraphiQL support
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
- Record
CVE-2026-59286- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-494
- Updated
- 2026-11-02
EUVDEUVD-2026-67175
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
- Record
EUVD-2026-67175- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wfp5-hffg-gvg8
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN,...
The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
- Record
GHSA-wfp5-hffg-gvg8- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-494
- Updated
- 2026-11-02
OSVCLSA-2026-1786693842 No score
TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (6 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1786693842- Updated
- 2026-11-02
OSVCLSA-2026-1788806164 No score
TuxCare security update for org.springframework.graphql:spring-graphql (3 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 3 CVEs. Fixed in 1.4.6-tuxcare.1.
- Record
CLSA-2026-1788806164- Updated
- 2026-11-02
Show 6 moreShow less
OSVCLSA-2026-1788870312 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.3.5-tuxcare.3.
- Record
CLSA-2026-1788870312- Updated
- 2026-11-02
OSVCLSA-2026-1788873403 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.2.9-tuxcare.5.
- Record
CLSA-2026-1788873403- Updated
- 2026-11-02
OSVCLSA-2026-1789150088 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1789150088- Updated
- 2026-11-02
OSVCLSA-2026-1789373257 No score
TuxCare security update for org.springframework.graphql:spring-graphql (4 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 4 CVEs. Fixed in 1.0.6-tuxcare.6.
- Record
CLSA-2026-1789373257- Updated
- 2026-11-02
OSVCLSA-2026-1791823173 No score
TuxCare security update for org.springframework.graphql:spring-graphql (2 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 2 CVEs. Fixed in 1.1.7-tuxcare.2.
- Record
CLSA-2026-1791823173- Updated
- 2026-11-02
OSVCLSA-2026-1791826672 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.2.4-tuxcare.1.
- Record
CLSA-2026-1791826672- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 3 CVEs |
1.4.6 up to 1.4.6-tuxcare.1 | 1.4.6-tuxcare.1 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 5 CVEs |
1.3.5 up to 1.3.5-tuxcare.3, plus listed versions 1.3.5-tuxcare.11.3.5-tuxcare.2 |
1.3.5-tuxcare.3 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 5 CVEs |
1.2.9 up to 1.2.9-tuxcare.5, plus listed versions 1.2.9-tuxcare.11.2.9-tuxcare.21.2.9-tuxcare.31.2.9-tuxcare.4 |
1.2.9-tuxcare.5 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 6 CVEs |
1.3.7 up to 1.3.7-tuxcare.4, plus listed versions 1.3.7-tuxcare.11.3.7-tuxcare.21.3.7-tuxcare.3 |
1.3.7-tuxcare.4 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 4 CVEs |
1.0.6 up to 1.0.6-tuxcare.6, plus listed versions 1.0.6-tuxcare.21.0.6-tuxcare.31.0.6-tuxcare.41.0.6-tuxcare.51.0.6.tuxcare.1 |
1.0.6-tuxcare.6 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 2 CVEs |
1.1.7 up to 1.1.7-tuxcare.2, plus listed versions 1.1.7-tuxcare.1 |
1.1.7-tuxcare.2 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 6 CVEs |
1.2.4 up to 1.2.4-tuxcare.1 | 1.2.4-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59286 is a high vulnerability (CVSS 8.1) in Spring For Graphql, published August 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 25th percentile. No source names a fixed version.