CVE-2026-41700

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.0.0 through 1.0.6 Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3

Description Applications using the WebSocket transport are susceptible to Cross-Site WebSocket Hijacking. This occurs when an attacker deceives an authenticated user into visiting a malicious website, enabling the attacker to perform arbitrary GraphQL operations using the victim's credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.