CVE-2026-41700: CWE-346: Origin Validation Error in Spring Spring for GraphQL
Affects Spring Spring for GraphQLSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 13% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| SpringSpring for GraphQL | Affected
| Fixed in
|
Mavenorg.springframework.graphql/spring-graphqlpkg:maven/org.springframework.graphql/spring-graphqlOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until an official fix is available, users should consider disabling WebSocket transport in Spring for GraphQL or implementing additional origin validation controls to prevent Cross-Site WebSocket Hijacking.
Description
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Impact
Successful exploitation results in an attacker executing arbitrary GraphQL operations with the privileges of an authenticated user, leading to high confidentiality and integrity impact. Availability is not affected. This can lead to unauthorized data access or modification within the affected application.
Summary
CVE-2026-41700 is an origin validation error (CWE-346) in Spring for GraphQL applications that have enabled WebSocket transport. The vulnerability allows Cross-Site WebSocket Hijacking, where an attacker can coerce an authenticated user to visit a malicious site and perform unauthorized GraphQL operations using the victim's credentials. The affected versions include Spring for GraphQL 1.0.0 through 1.0.6, 1.3.0 through 1.3.8, 1.4.0 through 1.4.5, and 2.0.0 through 2.0.3. No official patch or remediation level has been published yet.