CVE-2026-41856: Spring for GraphQL Annotation Detection Vulnerability
Summary
CVE-2026-41856: Spring for GraphQL: Annotation Detection Vulnerability. Affects org.springframework.graphql:spring-graphql across 4 version ranges.
>= 1.0.0, <= 1.0.6
>= 1.3.0, <= 1.3.8
>= 1.4.0, < 1.4.6
>= 2.0.0, < 2.0.4
Fixed in 1.4.6 or 2.0.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring for GraphQL is a framework that integrates Spring with GraphQL, allowing developers to build GraphQL APIs using the Spring programming model. It provides features such as data fetching, schema management, and integration with Spring's security and data access layers. However, it has a vulnerability related to its annotation detection mechanism, which may lead to security annotations being ignored at runtime, particularly in type hierarchies.
Vulnerability Detail
The vulnerability arises from the Spring GraphQL annotation detection mechanism for @Controller data fetchers, which may fail to correctly resolve annotations on methods within type hierarchies. This flaw can have serious security implications, as it may allow unauthorized access to resources if security annotations are not enforced as intended. The affected versions include Spring for GraphQL 2.0.0 through 2.0.3, 1.4.0 through 1.4.5, 1.3.0 through 1.3.8, and 1.0.0 through 1.0.6.
How To Fix
Latest published version: 2.1.0-RC1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.4.0, < 1.4.61.4.6 -
>= 2.0.0, < 2.0.42.0.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your application does not rely solely on the affected annotation detection mechanism for authorization decisions. Implement additional checks in your application logic to enforce security at runtime.
Conclusion
In summary, CVE-2026-41856 is a significant vulnerability in the Spring for GraphQL framework that can lead to unauthorized access due to improper annotation detection. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for org.springframework.graphql:spring-graphql →
FAQ
CVE-2026-41856 is a vulnerability in the Spring for GraphQL framework that affects the annotation detection mechanism for @Controller data fetchers.
Affected versions include Spring for GraphQL 2.0.0 through 2.0.3, 1.4.0 through 1.4.5, 1.3.0 through 1.3.8, and 1.0.0 through 1.0.6.
The vulnerability may lead to unauthorized access to resources if security annotations are ignored at runtime, compromising the application's security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply analyzing your pom.xml file, Vulert can help you identify if your application is affected by this vulnerability.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.graphql:spring-graphql.
