CVE-2026-41700 is an origin validation error vulnerability in Spring for GraphQL affecting versions 1.0.0 to 1.0.6, 1.3.0 to 1.3.8, 1.4.0 to 1.4.5, and 2.0.0 to 2.0.3. When WebSocket transport is enabled, the application is susceptible to Cross-Site WebSocket Hijacking, allowing attackers to leverage an authenticated user's session to perform arbitrary GraphQL operations. The vulnerability arises from improper origin validation, classified under CWE-346. The CVSS v3.1 base score is 8.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to execute arbitrary GraphQL operations with the credentials of an authenticated user by exploiting Cross-Site WebSocket Hijacking. This compromises the confidentiality and integrity of the affected application’s data and operations. Availability is not impacted. The vulnerability requires user interaction (the victim visiting a malicious page) but no privileges or prior authentication by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling WebSocket transport in Spring for GraphQL applications if feasible, or implement strict origin validation and CSRF protections on WebSocket connections to mitigate the risk of Cross-Site WebSocket Hijacking.