CVE-2026-41856: Spring for GraphQL: Annotation Detection Vulnerability

June 11, 2026 (updated August 21, 2026)

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.

Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

References

github.com/advisories/GHSA-phxq-526m-79px
github.com/spring-projects/spring-graphql/commit/63a89ed1379be646822dca9779b15dbf2ce45839
nvd.nist.gov/vuln/detail/CVE-2026-41856
spring.io/security/cve-2026-41856

Code Behaviors & Features

Detect and mitigate CVE-2026-41856 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →