CVE-2026-41700 Cross-Site WebSocket Hijacking in Spring for GraphQL

🗓️ 11 Jun 2026 05:04:47Reported by vmwareType

WebSocket transport in Spring for GraphQL enables cross-site hijacking to run operations as victim.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-41700	11 Jun 202608:00	–	circl
CNNVD	VMware Spring for GraphQL 访问控制错误漏洞	11 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41700	11 Jun 202605:04	–	cve
EUVD	EUVD-2026-36213	11 Jun 202605:04	–	euvd
NVD	CVE-2026-41700	11 Jun 202607:16	–	nvd
Positive Technologies	PT-2026-48626	11 Jun 202600:00	–	ptsecurity
Snyk	Origin Validation Error	10 Jun 202600:00	–	snyk
Spring Security Advisories	CVE-2026-41700: Cross-Site WebSocket Hijacking in Spring for GraphQL	10 Jun 202600:00	–	spring
vulnersOsv	com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0 <=5.5.0), com.contentmunch:blog-api (>=2.0.0.RELEASE <=2.0.1.RELEASE) +136 more potentially affected by CVE-2026-41700 via org.springframework.graphql:spring-graphql (>=1.0.0 <=1.4.5)	10 Jun 202600:00	–	vulnersosv
vulnersOsv	com.apollographql.federation:federation-spring-subscription-callback (>=5.0.0 <=6.1.0), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0 <=4.0.2) +45 more potentially affected by CVE-2026-41700 via org.springframework.graphql:spring-graphql (>=2.0.0-M1 <=2.0.3)	10 Jun 202600:00	–	vulnersosv

[
  {
    "vendor": "Spring",
    "product": "Spring for GraphQL",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.0",
        "lessThan": "2.0.3.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.4.0",
        "lessThan": "1.4.5.1",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.3.0",
        "lessThan": "1.3.9",
        "versionType": "custom"
      },
      {
        "status": "affected",
        "version": "1.0.0",
        "lessThan": "1.0.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
spring	www.spring.io/security/cve-2026-41700

30 Jun 2026 21:51Current

CVSS 3.18.1

EPSS0.00182

CWE-346