Spring GraphQL Annotation Resolution Vulnerability Leading to Auth Bypass (CVE-2026-41856)

Vulnerability Overview CVE ID: CVE-2026-41856 Vulnerability Name: Spring GraphQL Annotation Detection Vulnerability Severity: High Publication Date: June 10, 2026 Description: The annotation detection mechanism in Spring GraphQL may fail to correctly resolve annotations within the type hierarchy of methods when handling data fetchers. If these annotations are used for authorization decisions, this can lead to security issues. Impact Scope Affected Products and Versions: - Spring for GraphQL: - 2.0.0 – 2.0.3 - 1.4.0 – 1.4.5 - 1.3.0 – 1.3.8 - 1.0.0 – 1.0.6 Vulnerability Conditions: - The application has Spring Security on its classpath. - The application relies on Spring Security’s feature for security checks. - The application has classes implemented in its type hierarchy. Remediation Fixed Versions for Affected Releases: - 2.0.x → 2.0.4 (OSS) - 1.4.x → 1.4.6 (OSS) - 1.3.x → 1.3.9 (Commercial) - 1.0.x → 1.0.7 (Commercial) Recommendation: Users should upgrade to the corresponding fixed version. Additional Information Reporter: Bofei Chen Reference Links: NVD CVE-2026-41856 History: 2026-06-10: Initial vulnerability report published Summary This vulnerability involves issues with type hierarchy resolution when Spring GraphQL processes annotations, potentially leading to security problems in authorization decisions. Affected users should upgrade to the specified fixed versions as soon as possible.

Goal Reached Thanks to every supporter — we hit 100%!

Spring GraphQL Annotation Resolution Vulnerability Leading to Auth Bypass (CVE-2026-41856)