What is the CVSS score of CVE-2026-41700?

CVE-2026-41700 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring for GraphQL are affected by CVE-2026-41700?

Spring for GraphQL versions 1.0.x through 2.0.3 contain a vulnerability allowing attackers to perform unauthorized GraphQL operations on behalf of authenticated users through a compromised website or…. A patch is available.

How to fix or mitigate CVE-2026-41700?

Within 24 hours: Inventory all applications using Spring for GraphQL; identify those with WebSocket transport enabled and document current versions in production environments. Within 7 days: Implement compensating controls including strict origin validation on WebSocket handshakes, enforce SameSite=Strict on session cookies, and disable GraphQL WebSocket endpoints if not operationally required. Within 30 days: Monitor Spring for GraphQL security advisories; test and prepare upgrade plan to patched versions when released by vendor.

Spring for GraphQL CVE-2026-41700

EUVD-2026-36213 HIGH

Origin Validation Error (CWE-346)

2026-06-11 vmware

GHSA-m39w-hqxx-3r48

Java Information Disclosure Spring For Graphql

8.1

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable WebSocket endpoint, no attacker auth (PR:N), but victim must visit attacker page (UI:R); attacker reads and mutates victim data (C:H/I:H), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 08:01 EUVD

Analysis Generated

Jun 11, 2026 - 07:01 vuln.today

DescriptionCVE.org

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.

Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Articles & Coverage 2

News 7 New Java Vulnerabilities - 7 High Severity, No Public POC Jun 12, 2026 News 7 New Java Vulnerabilities - 7 High Severity, No Public Exploits Jun 11, 2026

AnalysisAI

Cross-Site WebSocket Hijacking in Spring for GraphQL allows remote attackers to execute arbitrary GraphQL operations under an authenticated victim's identity when the application has enabled the GraphQL WebSocket transport. The flaw stems from missing origin validation on WebSocket handshakes (CWE-346), affecting Spring for GraphQL 1.0.x, 1.3.x, 1.4.x, and 2.0.x branches up to 2.0.3. No public exploit identified at time of analysis, but the high CVSS (8.1) and reliance only on a single victim click make this a meaningful risk for any deployment exposing the WebSocket endpoint.

Technical ContextAI

Spring for GraphQL is VMware/Broadcom's official integration between the GraphQL Java engine and the Spring Framework (Spring MVC and Spring WebFlux). It supports the graphql-ws and graphql-transport-ws WebSocket sub-protocols to deliver subscriptions and streaming queries. CWE-346 (Origin Validation Error) applies here: WebSocket upgrade requests are not subject to the browser's Same-Origin Policy in the way XHR/fetch are, so a server that authenticates the upgrade purely via session cookies - without verifying the Origin header or requiring a CSRF-style token - will accept a connection initiated by any cross-origin page. The CPE cpe:2.3:a:spring:spring_for_graphql confirms the vulnerable component is the framework library itself, not a specific application built on top of it, so any downstream Spring Boot service pulling in a vulnerable spring-graphql artifact and exposing /graphql over WS inherits the issue.

RemediationAI

Upstream fix available per the Spring advisory (https://spring.io/security/cve-2026-41700); released patched version not independently confirmed in the provided data, but applications should upgrade to the latest maintenance release on their branch (2.0.4, 1.4.6, 1.3.9, or 1.0.7 family) once published by VMware/Broadcom. As an immediate compensating control, disable the GraphQL WebSocket transport in the GraphQlWebSocketHandler / GraphQlWebFluxAutoConfiguration if subscriptions are not used - this fully removes the attack surface but breaks any real-time subscription clients. Where WebSockets must remain enabled, add a server-side Origin header allowlist on the WebSocket handshake (e.g., via a HandshakeInterceptor or AllowedOrigins on the WebSocket configurer) restricted to your own front-end origins, and consider requiring a header-bound CSRF token rather than cookie-only authentication on the /graphql WebSocket endpoint; the trade-off is that legitimate cross-origin SPAs and CLI clients that previously relied on ambient cookies must be reconfigured.