CVE-2026-41856— Spring GraphQL Annotation Detection Vulnerability
Quick assessment
Affected
Spring Spring for GraphQL
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
VMware Spring for GraphQL是美国威睿（VMware）公司的一个GraphQL应用开发框架。 VMware Spring for GraphQL 2.0.0及之前版本、1.4.0及之前版本、1.3.0及之前版本和1.0.0及之前版本存在访问控制错误漏洞，该漏洞源于@Controller数据获取器的注解检测机制在类型层次结构中可能无法正确解析注解，可能导致安全注解在运行时被忽略。
Possible ATT&CK Techniques 2 AI
T1078.003 · Local Accounts T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Spring | Spring for GraphQL | 2.0.0< 2.0.3.1 |
affected |
1.4.0< 1.4.5.1 |
affected | ||
1.3.0< 1.3.9 |
affected | ||
1.0.0< 1.0.7 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-41856
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Spring GraphQL Annotation Detection Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.
Affected versions:
Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
VMware Spring for GraphQL 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Spring for GraphQL是美国威睿（VMware）公司的一个GraphQL应用开发框架。 VMware Spring for GraphQL 2.0.0及之前版本、1.4.0及之前版本、1.3.0及之前版本和1.0.0及之前版本存在访问控制错误漏洞，该漏洞源于@Controller数据获取器的注解检测机制在类型层次结构中可能无法正确解析注解，可能导致安全注解在运行时被忽略。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring for GraphQL | 2.0.0 ~ 2.0.3.1 | - |
|
II. Public POCs for CVE-2026-41856
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41856
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-41856 (1)
Same Patch Batch · Spring · 2026-06-11 · 15 CVEs total
| CVE-2026-40999 | 8.6 HIGH | Spring WS SSRF via unvalidated WS-Addressing reply destinations |
| CVE-2026-40994 | 8.2 HIGH | Wss4jSecurityInterceptor disables WS-I BSP validation by default |
| CVE-2026-40998 | 8.2 HIGH | Jaxp13 XPath XXE via StreamSource and SAXSource |
| CVE-2026-41699 | 8.1 HIGH | Unsafe Deserialization in Spring GraphQL |
| CVE-2026-41700 | 8.1 HIGH | Cross-Site WebSocket Hijacking in Spring for GraphQL |
| CVE-2026-40987 | 7.1 HIGH | Remote-file synchronizer in Spring Integration writes server-supplied filename under local |
| CVE-2026-40985 | 6.4 MEDIUM | Data Binding Vulnerability in Spring Web Flow with Unified EL Parser |
| CVE-2026-40995 | 5.4 MEDIUM | X.509 authentication bypasses Spring Security account checks |
| CVE-2026-40997 | 5.3 MEDIUM | SOAP security faults leak Spring Security account state |
| CVE-2026-41001 | 5.3 MEDIUM | Predictable Temp Directory in Artemis Auto-configuration |
| CVE-2026-40992 | 5.0 MEDIUM | Mail Auto-Configuration Does Not Enable SSL Hostname Verification |
| CVE-2026-40986 | 4.8 MEDIUM | Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML |
| CVE-2026-40996 | 4.8 MEDIUM | Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default |
| CVE-2026-41000 | 3.7 LOW | WSS4J validation does not use configured replay cache |
IV. Related Vulnerabilities
Same product: Spring for GraphQL
-
CVE-2026-59289
Spring for GraphQL Denial of Service via pagination support -
CVE-2026-59288
Spring for GraphQL Information Exposure in GraphiQL support -
CVE-2026-59287
Spring for GraphQL WebSocket Client Denial of Service -
CVE-2026-59286
Spring for GraphQL loads Untrusted Resources in GraphiQL sup -
CVE-2026-59285
Spring for GraphQL Unsafe Deserialization in pagination supp
Same vendor: Spring
-
CVE-2026-59324
fluxTransform shared RequestMessageHolder causes cross-messa -
CVE-2026-59322
EmbeddedHeadersJsonMessageMapper default gives wire peer ful -
CVE-2026-59321
Shared JSR-223 ScriptEngine evaluated concurrently without T -
CVE-2026-59320
In Spring AMQP the link credit never replenished on listener -
CVE-2026-59319
RediSearch Tag Injection in RedisChatMemoryRepository Allows
Same weakness: CWE-284
-
CVE-2026-123881
OpenBMB Internet of Agents Message app.py fetch_chat_record -
CVE-2026-49939
Apache James: Negative IMAP ACL administer authorization byp -
CVE-2026-104136
OpenEMR: Arbitrary Patient Recall and Contact Detail Read -
CVE-2026-104137
OpenEMR: Patient Data Search Without Sufficient ACL -
CVE-2026-115451
Joomla Extension - tassos.gr - File deletion through imprope