CVE-2026-41856: The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This…

PriorityP346high7.5CVSS 3.1

AVNACLPRNUINSUCHINAN

EPSS

0.35%

27.1th percentile

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
spring	spring_for_graphql	>= 1.0.0 < 1.0.7	1.0.7
spring	spring_for_graphql	>= 1.3.0 < 1.3.9	1.3.9
spring	spring_for_graphql	>= 1.4.0 < 1.4.5.1	1.4.5.1
spring	spring_for_graphql	>= 2.0.0 < 2.0.3.1	2.0.3.1
vmware	spring_for_graphql	>= 1.0.0 < 1.0.7	1.0.7
vmware	spring_for_graphql	>= 1.3.0 < 1.3.9	1.3.9
vmware	spring_for_graphql	>= 1.4.0 < 1.4.6	1.4.6
vmware	spring_for_graphql	>= 2.0.0 < 2.0.4	2.0.4

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.