HIGH | JUNE 10, 2026 | CVE-2026-41700
Description
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking.
More precisely, an application is vulnerable when all the following are true:
- the application has enabled the GraphQL WebSocket transport
- the application relies on cookie-based session authentication
- the application does not have custom Spring Security WebSocket-level Origin enforcement configured
When all the conditions above are met, an attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected Spring Products and Versions
Spring for GraphQL:
- 2.0.0 - 2.0.3
- 1.4.0 - 1.4.5
- 1.3.0 - 1.3.8
- 1.0.0 - 1.0.6
Versions that are no longer supported are also affected.
Mitigation
Users of affected versions should upgrade to the corresponding fixed version.
| Affected version(s) | Fix version | Availability |
|---|---|---|
| 2.0.x | 2.0.4 | OSS |
| 1.4.x | 1.4.6 | OSS |
| 1.3.x | 1.3.9 | Commercial |
| 1.0.x | 1.0.7 | Commercial |
No further mitigation steps are necessary.
Credit
This issue was discovered internally.
References
History
- 2026-06-10: Initial vulnerability report published.
Reporting a vulnerability
To report a security vulnerability for a project within the Spring portfolio, see the Security Policy