# CVE-2026-41700: VMware Spring for GraphQL Cross-Site WebSocket Hijacking

Source: https://junglewise.ai/threats/cve-2026-41700-vmware-spring-for-graphql-cross-site-websocket-hijacking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41700 · Severity: high · CVSS 8.1 · Published 2026-06-11

Spring for GraphQL is a framework that enables GraphQL API support in Spring Boot applications, often used for real-time data queries. When WebSocket transport is enabled, the application becomes vulnerable to cross-site WebSocket hijacking attacks. An attacker can trick an authenticated user into visiting a malicious webpage, allowing the attacker to send arbitrary GraphQL requests using the victim's session credentials, potentially exposing sensitive data or making unauthorized modifications.

Technologies: [org.springframework.graphql:spring-graphql (Maven)](https://junglewise.ai/threats/technologies/org-springframework-graphql-spring-graphql), [VMware Spring for GraphQL](https://junglewise.ai/threats/technologies/spring-for-graphql). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41700 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41700 being exploited in the wild.

**How severe is CVE-2026-41700?** High severity, with a CVSS score of 8.1, published 11 June 2026.

**Which products and versions are affected?** org.springframework.graphql:spring-graphql (Maven) ECOSYSTEM:introduced=2.0.0,fixed=2.0.4; VMware Spring for GraphQL 2.0.0 through 2.0.3, 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

**Is there a fix for CVE-2026-41700?** Yes. org.springframework.graphql:spring-graphql (Maven): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41700 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41700?** Check whether you run org.springframework.graphql:spring-graphql (Maven) or VMware Spring for GraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.graphql:spring-graphql (Maven): upgrade to 2.0.4 or later

  ```sh
  # set org.springframework.graphql:spring-graphql to 2.0.4 in your pom.xml or build.gradle
  ```


## Technical details

This vulnerability is a cross-site WebSocket hijacking (CSWSH) flaw caused by improper origin validation in the WebSocket connection handler. The root cause is an origin validation error (CWE-346) in the GraphQlWebSocketHandler component. An attacker can craft a malicious web page that, when visited by an authenticated user, initiates a WebSocket connection to the target GraphQL API. Because the WebSocket handshake does not properly validate the origin of the request, the server accepts the connection and processes GraphQL operations using the victim's existing authentication credentials. No special privileges or authentication bypass is required from the attacker; only user interaction (visiting a malicious page) is needed. The attack vector is network-based and can be executed remotely. Patches are available: version 2.0.4, 1.4.6, and later versions include fixes that properly validate WebSocket origins and refuse cross-origin connections.

## Affected products

- Spring Spring for GraphQL 2.0.0 through 2.0.3
- Spring Spring for GraphQL 1.4.0 through 1.4.5
- Spring Spring for GraphQL 1.3.0 through 1.3.8
- Spring Spring for GraphQL 1.0.0 through 1.0.6

## Identifiers

- CVE-2026-41700
- GHSA-m39w-hqxx-3r48

## Timeline

- 2026-06-11: disclosed
- 2026-06-11: patched: Patches released: version 2.0.4, 1.4.6

## References

- [https://spring.io/security/cve-2026-41700](https://spring.io/security/cve-2026-41700)
- [https://github.com/spring-projects/spring-graphql/commit/3ebad2713f52e04e6dc892b5adb79a29e14f4a1a](https://github.com/spring-projects/spring-graphql/commit/3ebad2713f52e04e6dc892b5adb79a29e14f4a1a)

## Related threats

- [Spring for GraphQL Spring Data pagination denial of service](https://junglewise.ai/threats/cve-2026-59289-spring-for-graphql-spring-data-pagination-denial-of-service)
- [Spring for GraphQL denial of service with WebSocket keepAlive](https://junglewise.ai/threats/cve-2026-59287-spring-for-graphql-denial-of-service-with-websocket-keepalive)
- [Spring for GraphQL missing Subresource Integrity on CDN-loaded JavaScript](https://junglewise.ai/threats/cve-2026-59286-spring-for-graphql-missing-subresource-integrity-on-cdn-loaded)
- [Spring for GraphQL unsafe deserialization in pagination](https://junglewise.ai/threats/cve-2026-59285-spring-for-graphql-unsafe-deserialization-in-pagination)
- [VMware Spring for GraphQL authorization bypass in @Controller data fetchers](https://junglewise.ai/threats/cve-2026-41856-vmware-spring-for-graphql-authorization-bypass-in-controller-data)