CVE-2026-41700

published 2026-06-11

CVE-2026-41700: Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an…

Priority P3 42 high 8.1 CVSS 3.1

AV N AC L PR N UI R S U C H I H A N

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.

Affected versions:
Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
spring	spring_for_graphql	>= 1.0.0 < 1.0.7	1.0.7
spring	spring_for_graphql	>= 1.3.0 < 1.3.9	1.3.9
spring	spring_for_graphql	>= 1.4.0 < 1.4.5.1	1.4.5.1
spring	spring_for_graphql	>= 2.0.0 < 2.0.3.1	2.0.3.1
vmware	spring_for_graphql	>= 1.0.0 < 1.0.7	1.0.7
vmware	spring_for_graphql	>= 1.3.0 < 1.3.9	1.3.9
vmware	spring_for_graphql	>= 1.4.0 < 1.4.6	1.4.6
vmware	spring_for_graphql	>= 2.0.0 < 2.0.4	2.0.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-346