Read the docs
TI-2026-30266 Aliases CVE-2026-41856GHSA-phxq-526m-79px

Spring GraphQL Annotation Detection Vulnerability

Priority LOW 39CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00352 29th percentileScored 2026-11-07
Fix Fixed Spring for GraphQL (Spring): 2.0.3.1, 1.4.5.1, 1.3.9 +1org.springframework.graphql:spring-graphql (Maven): 2.0.4, 1.4.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMwareSpring for GraphQL2.0.0 to before 2.0.3.1; 1.4.0 to before 1.4.5.1; 1.3.0 to before 1.3.9; 1.0.0 to before 1.0.72.0.3.1, 1.4.5.1, 1.3.9, 1.0.7Patch availableCNA
—org.springframework.graphql:spring-graphql (Maven)2.0.0 to before 2.0.42.0.4Patch availableGHSA-phxq-526m-79px
—org.springframework.graphql:spring-graphql (Maven)1.4.0 to before 1.4.61.4.6Patch availableGHSA-phxq-526m-79px
—org.springframework.graphql:spring-graphql (Maven)1.3.0 – 1.3.8—No fix listedGHSA-phxq-526m-79px
—org.springframework.graphql:spring-graphql (Maven)1.0.0 – 1.0.6—No fix listedGHSA-phxq-526m-79px
  • Spring for GraphQL VendorVMware Affected 2.0.0 to before 2.0.3.1; 1.4.0 to before 1.4.5.1; 1.3.0 to before 1.3.9; 1.0.0 to before 1.0.7 Fixed in 2.0.3.1, 1.4.5.1, 1.3.9, 1.0.7 Patch available CNA
  • org.springframework.graphql:spring-graphql (Maven) Vendor— Affected 2.0.0 to before 2.0.4 Fixed in 2.0.4 Patch available GHSA-phxq-526m-79px
  • org.springframework.graphql:spring-graphql (Maven) Vendor— Affected 1.4.0 to before 1.4.6 Fixed in 1.4.6 Patch available GHSA-phxq-526m-79px
  • org.springframework.graphql:spring-graphql (Maven) Vendor— Affected 1.3.0 – 1.3.8 Fixed in — No fix listed GHSA-phxq-526m-79px
  • org.springframework.graphql:spring-graphql (Maven) Vendor— Affected 1.0.0 – 1.0.6 Fixed in — No fix listed GHSA-phxq-526m-79px

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:*1.0.0 to before 1.0.7; 1.3.0 to before 1.3.9; 1.4.0 to before 1.4.5.1; 2.0.0 to before 2.0.3.1VulnerableVMware
  • cpe:2.3:a:vmware:spring_for_graphql:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.0.7; 1.3.0 to before 1.3.9; 1.4.0 to before 1.4.5.1; 2.0.0 to before 2.0.3.1 Vulnerable ·VMware

Remediation

  • Fix · CNA Spring for GraphQL (Spring) Fixed in 2.0.3.1, 1.4.5.1, 1.3.9, 1.0.7
  • Fix · GHSA-phxq-526m-79px org.springframework.graphql:spring-graphql (Maven) Fixed in 2.0.4 Advisory →
  • Fix · GHSA-phxq-526m-79px org.springframework.graphql:spring-graphql (Maven) Fixed in 1.4.6 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Spring for GraphQL 1.0.7, 1.3.9 and 2 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-30216 Cross-Site WebSocket Hijacking in Spring for GraphQLPriority LOW 36
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41856
  2. 2026-10-03 Alias added: GHSA-phxq-526m-79px

References

Advisory 2

Other 2

  • TI-2026-30215 Unsafe Deserialization in Spring GraphQL CVSS 3.1CRITICAL 9.8
  • TI-2026-42422 Spring for GraphQL Denial of Service via pagination support CVSS 3.1HIGH 7.5
  • TI-2026-42421 Spring for GraphQL Information Exposure in GraphiQL support CVSS 3.1HIGH 7.5
  • TI-2026-42418 Spring for GraphQL Unsafe Deserialization in pagination support CVSS 3.1HIGH 8.1
  • TI-2026-42419 Spring for GraphQL loads Untrusted Resources in GraphiQL support CVSS 3.1HIGH 8.1
  • TI-2026-30216 Cross-Site WebSocket Hijacking in Spring for GraphQL CVSS 3.1HIGH 8.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences