CVE-2026-41856: VMware Spring for GraphQL authorization bypass in @Controller data fetchers

CVE-2026-41856 · Severity: high · CVSS 7.5 · Published 2026-06-11

Spring for GraphQL is a framework that enables GraphQL APIs within Spring applications. A flaw in annotation detection allows security-related annotations (such as authorization checks) on controller data fetcher methods to be incorrectly ignored at runtime when methods are defined in generic interface hierarchies. This can allow unauthorized access to sensitive GraphQL endpoints that should be protected.

Technologies: org.springframework.graphql:spring-graphql (Maven), VMware Spring for GraphQL. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41856 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41856 being exploited in the wild.
How severe is CVE-2026-41856?
High severity, with a CVSS score of 7.5, published 11 June 2026.
Which products and versions are affected?
org.springframework.graphql:spring-graphql (Maven) ECOSYSTEM:introduced=2.0.0,fixed=2.0.4; VMware Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Is there a fix for CVE-2026-41856?
Yes. org.springframework.graphql:spring-graphql (Maven): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41856 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41856?
Check whether you run org.springframework.graphql:spring-graphql (Maven) or VMware Spring for GraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.graphql:spring-graphql (Maven): upgrade to 2.0.4 or later
    # set org.springframework.graphql:spring-graphql to 2.0.4 in your pom.xml or build.gradle

Technical details

The vulnerability exists in Spring for GraphQL's annotation detection mechanism for @Controller data fetchers. When handler methods are defined in generic interface hierarchies, the framework's bridged method matching in HandlerMethod fails to correctly resolve parameter annotations (such as @Argument and authorization annotations) on the concrete implementation. The root cause is improper type resolution when comparing bridged method parameter types using ResolvableType.resolve(), which cannot match erased parameter types. The fix uses ResolvableType.toClass() to correctly match raw classes. This is a logic flaw (CWE-284: Improper Access Control) that requires the specific condition of methods in generic interfaces, affecting only applications using such patterns for authorization enforcement. The vulnerability is network-reachable via GraphQL queries and requires no authentication or user interaction to exploit. Patches are available: versions 2.0.4, 1.4.6, and later.

Affected products

  • Spring Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6

Identifiers

  • CVE-2026-41856
  • GHSA-phxq-526m-79px

Timeline

  • 2026-06-11: disclosed: Published to GitHub Advisory Database and NVD
  • 2026-06-11: patched: Patched versions 2.0.4 and 1.4.6 released; 1.3.x and 1.0.x end-of-life

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.