CVE-2026-41700: Spring for GraphQL: Cross-Site WebSocket Hijacking

June 11, 2026 (updated August 21, 2026)

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim’s credentials.

Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

References

github.com/advisories/GHSA-m39w-hqxx-3r48
github.com/spring-projects/spring-graphql/commit/3ebad2713f52e04e6dc892b5adb79a29e14f4a1a
nvd.nist.gov/vuln/detail/CVE-2026-41700
spring.io/security/cve-2026-41700

Code Behaviors & Features

Detect and mitigate CVE-2026-41700 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →