Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-41700— Cross-Site WebSocket Hijacking in Spring for GraphQL

CVSS 8.1 · High EPSS 0.18% · P8

Affected Version Matrix 4

VendorProductVersion RangeStatus
SpringSpring for GraphQL2.0.0< 2.0.4affected
1.4.0< 1.4.6affected
1.3.0< 1.3.9affected
1.0.0< 1.0.7affected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-41700

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Cross-Site WebSocket Hijacking in Spring for GraphQL
Source: NVD (National Vulnerability Database)
Vulnerability Description
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
源验证错误
Source: NVD (National Vulnerability Database)
Vulnerability Title
VMware Spring for GraphQL 访问控制错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Spring for GraphQL是美国威睿（VMware）公司的一个GraphQL应用开发框架。 VMware Spring for GraphQL 2.0.0及之前版本、1.4.0及之前版本、1.3.0及之前版本和1.0.0及之前版本存在访问控制错误漏洞，该漏洞源于启用WebSocket传输时存在跨站WebSocket劫持，可能导致攻击者利用受害者凭据执行任意GraphQL操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
SpringSpring for GraphQL 2.0.0 ~ 2.0.4 -

II. Public POCs for CVE-2026-41700

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-41700

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-41700 (1)

Same Patch Batch · Spring · 2026-06-11 · 15 CVEs total

CVE-2026-409998.6 HIGHSpring WS SSRF via unvalidated WS-Addressing reply destinations
CVE-2026-409988.2 HIGHJaxp13 XPath XXE via StreamSource and SAXSource
CVE-2026-409948.2 HIGHWss4jSecurityInterceptor disables WS-I BSP validation by default
CVE-2026-416998.1 HIGHUnsafe Deserialization in Spring GraphQL
CVE-2026-418567.5 HIGHSpring GraphQL Annotation Detection Vulnerability
CVE-2026-409877.1 HIGHRemote-file synchronizer in Spring Integration writes server-supplied filename under local
CVE-2026-409856.4 MEDIUMData Binding Vulnerability in Spring Web Flow with Unified EL Parser
CVE-2026-409955.4 MEDIUMX.509 authentication bypasses Spring Security account checks
CVE-2026-410015.3 MEDIUMPredictable Temp Directory in Artemis Auto-configuration
CVE-2026-409975.3 MEDIUMSOAP security faults leak Spring Security account state
CVE-2026-409925.0 MEDIUMMail Auto-Configuration Does Not Enable SSL Hostname Verification
CVE-2026-409964.8 MEDIUMInbound WS-Security allows RSA PKCS#1 v1.5 key transport by default
CVE-2026-409864.8 MEDIUMSpring Web Flow JS RemotingHandler renders non-HTML Response as HTML
CVE-2026-410003.7 LOWWSS4J validation does not use configured replay cache

IV. Related Vulnerabilities

Same product: Spring for GraphQL
Same vendor: Spring
Same weakness: CWE-346

V. Comments for CVE-2026-41700

No comments yet

Leave a comment