What is the CVSS score of CVE-2026-41856?

CVE-2026-41856 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring for GraphQL are affected by CVE-2026-41856?

Spring for GraphQL versions 1.0 through 2.0 contain an authorization bypass vulnerability allowing unauthenticated remote attackers to invoke protected controller methods through inherited security…. A patch is available.

How to fix or mitigate CVE-2026-41856?

24 hours: Identify all applications using Spring for GraphQL 1.0.0-1.0.6, 1.3.0-1.3.8, 1.4.0-1.4.5, or 2.0.0-2.0.3; audit GraphQL endpoints for inherited @Controller and security annotations. 7 days: Implement network-level access controls restricting GraphQL endpoint exposure; deploy WAF rules to enforce authentication validation; add application-level authorization checks independent of Spring annotation inheritance. 30 days: Monitor vendor advisories for patch release; plan upgrade strategy or evaluate architectural alternatives if patch timeline extends beyond 90 days.

Spring for GraphQL CVE-2026-41856

EUVD-2026-36214 HIGH

Improper Access Control (CWE-284)

2026-06-11 vmware

GHSA-phxq-526m-79px

Authentication Bypass Java Spring For Graphql

7.5

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable GraphQL endpoint, no auth or user interaction needed, bypass leaks data the fetcher returns (C:H) without altering state (I:N/A:N); scope unchanged within the app.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 11, 2026 - 08:01 EUVD

Analysis Generated

Jun 11, 2026 - 07:02 vuln.today

DescriptionCVE.org

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.

Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Articles & Coverage 2

News 7 New Java Vulnerabilities - 7 High Severity, No Public POC Jun 12, 2026 News 7 New Java Vulnerabilities - 7 High Severity, No Public Exploits Jun 11, 2026

AnalysisAI

Authorization bypass in Spring for GraphQL (versions 1.0.0-1.0.6, 1.3.0-1.3.8, 1.4.0-1.4.5, and 2.0.0-2.0.3) allows remote attackers to invoke @Controller data fetcher methods whose security annotations are declared on parent classes or interfaces, because the framework's annotation detection does not consistently resolve annotations across type hierarchies. The flaw is rated CVSS 7.5 (confidentiality-only impact) and no public exploit identified at time of analysis, but the network-reachable, no-privilege CVSS vector makes any affected GraphQL endpoint a meaningful exposure.

Technical ContextAI

Spring for GraphQL is VMware/Broadcom's integration layer that maps GraphQL operations onto Spring MVC/WebFlux @Controller beans, with each field backed by a @SchemaMapping/@QueryMapping/@MutationMapping data fetcher method. Authorization is commonly enforced by stacking annotations such as @PreAuthorize, @Secured, or method-security meta-annotations on those handler methods, often inherited from a base class or interface. The bug - classified as CWE-284 Improper Access Control - is in the reflective annotation lookup used when constructing the data fetcher: when the concrete method overrides or inherits a method that carries the security annotation on the supertype, the lookup may fail to surface that annotation, so Spring Security's method interceptor sees an unguarded method and the data fetcher executes without the intended check. The CPE cpe:2.3:a:spring:spring_for_graphql:*:*:*:*:*:*:*:* covers all maintained branches affected.

RemediationAI

Upgrade the org.springframework.graphql:spring-graphql dependency to a fixed maintenance release on your branch as listed in the Spring advisory at https://spring.io/security/cve-2026-41856 (2.0.x users should move past 2.0.3, 1.4.x past 1.4.5, 1.3.x past 1.3.8, and 1.0.x past 1.0.6); exact fix versions should be taken from that advisory rather than guessed. As a workaround until the upgrade lands, move @PreAuthorize/@Secured/method-security annotations off base classes and interfaces and onto the concrete @SchemaMapping/@QueryMapping/@MutationMapping methods themselves so annotation lookup cannot miss them, which closes the gap at the cost of some duplication; alternatively, enforce authorization in a GraphQL interceptor (WebGraphQlInterceptor) or at the API gateway, accepting that you lose method-granular policies. Audit logs and access patterns on sensitive queries/mutations before and after the change.