CVE-2026-59288
Spring for GraphQL Information Exposure in GraphiQL support
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
- Record
CVE-2026-59288- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List
Spring for GraphQL Information Exposure in GraphiQL support
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
- Record
CVE-2026-59288- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2026-67177
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
- Record
EUVD-2026-67177- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-32wx-2g57-hccx
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the...
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
- Record
GHSA-32wx-2g57-hccx- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVCLSA-2026-1786693842 No score
TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (6 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1786693842- Updated
- 2026-11-02
OSVCLSA-2026-1788806164 No score
TuxCare security update for org.springframework.graphql:spring-graphql (3 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 3 CVEs. Fixed in 1.4.6-tuxcare.1.
- Record
CLSA-2026-1788806164- Updated
- 2026-11-02
Show 6 moreShow less
OSVCLSA-2026-1788870312 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.3.5-tuxcare.3.
- Record
CLSA-2026-1788870312- Updated
- 2026-11-02
OSVCLSA-2026-1788873403 No score
TuxCare security update for org.springframework.graphql:spring-graphql (5 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 5 CVEs. Fixed in 1.2.9-tuxcare.5.
- Record
CLSA-2026-1788873403- Updated
- 2026-11-02
OSVCLSA-2026-1789150088 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.3.7-tuxcare.4.
- Record
CLSA-2026-1789150088- Updated
- 2026-11-02
OSVCLSA-2026-1789373257 No score
TuxCare security update for org.springframework.graphql:spring-graphql (4 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 4 CVEs. Fixed in 1.0.6-tuxcare.6.
- Record
CLSA-2026-1789373257- Updated
- 2026-11-02
OSVCLSA-2026-1789710059 No score
TuxCare security update for org.springframework.graphql:spring-graphql (2 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 2 CVEs. Fixed in 1.1.7-tuxcare.1.
- Record
CLSA-2026-1789710059- Updated
- 2026-11-02
OSVCLSA-2026-1791826672 No score
TuxCare security update for org.springframework.graphql:spring-graphql (6 CVEs)
TuxCare rebuilt org.springframework.graphql:spring-graphql to address 6 CVEs. Fixed in 1.2.4-tuxcare.1.
- Record
CLSA-2026-1791826672- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 3 CVEs |
1.4.6 up to 1.4.6-tuxcare.1 | 1.4.6-tuxcare.1 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 5 CVEs |
1.3.5 up to 1.3.5-tuxcare.3, plus listed versions 1.3.5-tuxcare.11.3.5-tuxcare.2 |
1.3.5-tuxcare.3 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 5 CVEs |
1.2.9 up to 1.2.9-tuxcare.5, plus listed versions 1.2.9-tuxcare.11.2.9-tuxcare.21.2.9-tuxcare.31.2.9-tuxcare.4 |
1.2.9-tuxcare.5 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 6 CVEs |
1.3.7 up to 1.3.7-tuxcare.4, plus listed versions 1.3.7-tuxcare.11.3.7-tuxcare.21.3.7-tuxcare.3 |
1.3.7-tuxcare.4 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 4 CVEs |
1.0.6 up to 1.0.6-tuxcare.6, plus listed versions 1.0.6-tuxcare.21.0.6-tuxcare.31.0.6-tuxcare.41.0.6-tuxcare.51.0.6.tuxcare.1 |
1.0.6-tuxcare.6 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 2 CVEs |
1.1.7 up to 1.1.7-tuxcare.1 | 1.1.7-tuxcare.1 |
org.springframework.graphql:spring-graphqlTuxCare:Maven From an advisory covering 6 CVEs |
1.2.4 up to 1.2.4-tuxcare.1 | 1.2.4-tuxcare.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59288 is a high vulnerability (CVSS 7.4) in Spring For Graphql, published August 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. No source names a fixed version.