com.apollographql.federation:federation-spring-subscription-callback (>=6.0.0, <=6.2.1), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0, <=4.0.2) +53 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=2.0.0, <=2.0.3)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0, =6.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter 1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources 1.4.0 -...

com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2), com.graphql-java-generator:graphql-java-client-dependencies (>=3.0, <=3.1) +73 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=1.4.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.4.0, =1.0.1, =3.0, =3.0, =3.0, =3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.6.0 and more Source cves: CVE-2026-41699 Source advisory: MEN...

CVE-2026-41699 Unsafe Deserialization in Spring GraphQL

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated Connection field and the classpath contains specifi...

PT-2026-48626

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.0.0 through 1.0.6 Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3 Description Applications using the WebSocket...

VMware Spring for GraphQL Access Control Vulnerability

VMware Spring for GraphQL is a GraphQL application development framework provided by the American company VMware. Versions of VMware Spring for GraphQL such as 2.0.0 and earlier, 1.4.0 and earlier, 1.3.0 and earlier, as well as 1.0.0 and earlier, have a access control vulnerability. This...

PT-2026-48627

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.0.0 through 1.0.6 Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3 Description The annotation detection mechanism for...

PT-2026-80298

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

CVE-2026-41856: Improper Access Control

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored...

PT-2026-80300

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated Connection field and the classpath contains specifi...

PT-2026-80287

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials...

CVE-2026-41700: Origin Validation Error

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials...

CVE-2026-41699: Deserialization of Untrusted Data

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated Connection field and the classpath contains specifi...

VMware Spring for GraphQL Access Control Vulnerability

VMware Spring for GraphQL is a GraphQL application development framework provided by the American company VMware. Versions of VMware Spring for GraphQL such as 2.0.0 and earlier, 1.4.0 and earlier, 1.3.0 and earlier, as well as 1.0.0 and earlier, contain an access control vulnerability. This...

PT-2026-48625

Name of the Vulnerable Software and Affected Versions Spring for GraphQL versions 1.3.0 through 1.3.8 Spring for GraphQL versions 1.4.0 through 1.4.5 Spring for GraphQL versions 2.0.0 through 2.0.3 Description Applications are susceptible to unsafe deserialization when processing paginated GraphQ...

VMware Spring for GraphQL code issues and vulnerabilities

VMware Spring for GraphQL is a GraphQL application development framework provided by the American company VMware. Versions of VMware Spring for GraphQL such as 2.0.0, 1.4.0, and 1.3.0 contain code vulnerabilities. These vulnerabilities stem from insecure deserialization during the processing of...

com.apollographql.federation:federation-spring-subscription-callback (>=6.0.0, <=6.2.1), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0, <=4.0.2) +53 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=2.0.0-m1, <=2.0.3)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0-m1, =6.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter 1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources 1.4.0 -...

Incorrect Authorization

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Incorrect Authorization via annotation resolution for @Controller data fetchers in Spring GraphQL. An attacker can bypass authorization checks when...

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=5.5.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +140 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=1.0.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.release, =1.0.1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0 - com.graphql-java-generator:graphql-maven-plugin-samples-allgraphqlcases-client 2.0rc1 -...

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=5.5.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +140 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=1.0.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.release, =1.0.1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0 - com.graphql-java-generator:graphql-maven-plugin-samples-allgraphqlcases-client 2.0rc1 -...

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0, <=5.5.0), com.contentmunch:blog-api (>=2.0.0.release, <=2.0.1.release) +140 more potentially affected by CVE-2026-41700 via org.springframework.graphql:spring-graphql (>=1.0.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.release, =1.0.1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0 - com.graphql-java-generator:graphql-maven-plugin-samples-allgraphqlcases-client 2.0rc1 -...