CVE-2026-59288: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Spring Spring for GraphQL

The vulnerability CVE-2026-59288 in Spring for GraphQL arises from the GraphiQL page sending requests to the application's GraphQL endpoints. An attacker can craft and share a malicious URL that, when visited by a victim, causes the victim's browser to inadvertently leak sensitive information to the attacker's site. The affected versions include Spring for GraphQL 1.0.0 through 1.0.7, 1.1.0 through 1.3.9, 1.4.0 through 1.4.6, and 2.0.0 through 2.0.4. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and has a CVSS v3.1 base score of 7.5, indicating high severity. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the affected application to an attacker-controlled website. This exposure occurs without requiring any privileges or user interaction, potentially compromising confidentiality of data handled by the GraphQL endpoints.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the GraphiQL interface to prevent exposure via malicious URLs. Monitor vendor channels for updates and apply patches promptly once released.