CVE-2026-41856

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.0.0 through 1.0.6 Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3

Description The annotation detection mechanism for @Controller data fetchers may fail to correctly resolve annotations on methods located within type hierarchies. This failure can lead to security annotations being ignored at runtime, which is critical if those annotations are utilized to make authorization decisions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.