CVE-2026-41700: Spring for GraphQL Cross-Site WebSocket Hijacking Vulnerability
Summary
CVE-2026-41700: Spring for GraphQL: Cross-Site WebSocket Hijacking. Affects org.springframework.graphql:spring-graphql across 4 version ranges.
>= 1.0.0, <= 1.0.6
>= 1.3.0, <= 1.3.8
>= 1.4.0, < 1.4.6
>= 2.0.0, < 2.0.4
Fixed in 1.4.6 or 2.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring for GraphQL is a framework that facilitates the development of GraphQL applications in Java, providing a robust environment for building APIs. It supports various transport mechanisms, including WebSocket, which allows for real-time communication between clients and servers. However, when the WebSocket transport is enabled, it becomes susceptible to specific security vulnerabilities, including Cross-Site WebSocket Hijacking.
Vulnerability Detail
The vulnerability arises from the ability of an attacker to trick an authenticated user into visiting a malicious webpage. This can lead to the execution of arbitrary GraphQL operations using the victim's credentials, potentially compromising sensitive data and application integrity. The affected versions of Spring for GraphQL range from 2.0.0 to 2.0.3, 1.4.0 to 1.4.5, 1.3.0 to 1.3.8, and 1.0.0 to 1.0.6, making it critical for users of these versions to take immediate action.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.4.0, < 1.4.61.4.6 -
>= 2.0.0, < 2.0.42.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, consider disabling the WebSocket transport in your Spring for GraphQL application until you can apply the necessary updates. This can be done by modifying your application configuration to exclude WebSocket support.
Conclusion
The Cross-Site WebSocket Hijacking vulnerability in Spring for GraphQL poses significant risks to applications using affected versions. It is crucial to update to the latest patched versions or disable WebSocket transport to mitigate potential threats. Regular monitoring and vulnerability assessments are essential for maintaining application security.
See every vulnerability recorded for org.springframework.graphql:spring-graphql →
FAQ
Cross-Site WebSocket Hijacking is a security vulnerability that allows an attacker to execute unauthorized WebSocket requests on behalf of an authenticated user.
The affected versions are Spring for GraphQL 2.0.0 through 2.0.3, 1.4.0 through 1.4.5, 1.3.0 through 1.3.8, and 1.0.0 through 1.0.6.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without needing to sign up.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
If immediate updates are not possible, consider disabling the WebSocket transport as a temporary workaround until you can apply the necessary patches.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.graphql:spring-graphql.
