Incorrect Authorization

org.springframework.graphql:spring-graphql is vulnerable to Improper Authorization. The vulnerability is due to incorrect resolution of security annotations on @Controller data fetcher methods within type hierarchies, which allows an attacker to bypass authorization checks when security annotatio...

Unsafe Deserialization

org.springframework.graphql, spring-graphql is vulnerable to Unsafe Deserialization. The vulnerability is due to unsafe deserialization of data when processing paginated GraphQL queries, which allows an attacker to craft a malicious GraphQL request and potentially achieve Remote Code Execution RC...

K000162466: Spring GraphQL vulnerability CVE-2026-41856

Security Advisory Description The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met,...

This Week in Spring - June 16th, 2026

Hi Spring fans! Welcome to another installment of This Week in Spring! I'm writing this from the oh-so-delightful and delicious! city of New Delhi, India. It's been a real privilege to come and visit so many amazing people. Last night my friend DaShaun and I presented here at the local Delhi JUG,...

com.graphql-java-generator.graphql-gradle-plugin:com.graphql-java-generator.graphql-gradle-plugin.gradle.plugin (>=2.0rc1, <=2.0), com.graphql-java-generator:graphql-gradle-plugin (>=2.0rc1, <=2.0) +42 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=1.0.0, <=1.0.6)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0 - com.graphql-java-generator:graphql-maven-plugin-samples-allgraphqlcases-client 2.0rc1 -...

com.graphql-java-generator.graphql-gradle-plugin:com.graphql-java-generator.graphql-gradle-plugin.gradle.plugin (>=2.0rc1, <=2.0), com.graphql-java-generator:graphql-gradle-plugin (>=2.0rc1, <=2.0) +42 more potentially affected by CVE-2026-41700 via org.springframework.graphql:spring-graphql (>=1.0.0, <=1.0.6)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0 - com.graphql-java-generator:graphql-maven-plugin-samples-allgraphqlcases-client 2.0rc1 -...

com.graphql-java-generator.graphql-gradle-plugin:com.graphql-java-generator.graphql-gradle-plugin.gradle.plugin (>=2.0rc1, <=2.0), com.graphql-java-generator:graphql-gradle-plugin (>=2.0rc1, <=2.0) +42 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=1.0.0, <=1.0.6)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0rc1, =2.0 - com.graphql-java-generator:graphql-maven-plugin-samples-allgraphqlcases-client 2.0rc1 -...

com.apollographql.federation:federation-spring-subscription-callback (>=5.1.0, <=5.5.0), com.introproventures:graphql-jpa-query-test-boot-starter (>=1.2.8, <=1.2.15) +48 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=1.3.0, <=1.3.7)

org.springframework.graphql:spring-graphql MAVEN version =1.3.0, =5.1.0, =1.2.8, =1.2.8, =1.2.8, =1.2.8, =10.0.0, =10.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.1.1, =1.0.0, =1.17.2, =1.17.2, =1.20.2 and more Source cves: CVE-2026-41856https://vulners.com/cve/CVE-2026-4185...

com.apollographql.federation:federation-spring-subscription-callback (>=5.1.0, <=5.5.0), com.introproventures:graphql-jpa-query-test-boot-starter (>=1.2.8, <=1.2.15) +48 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=1.3.0, <=1.3.7)

org.springframework.graphql:spring-graphql MAVEN version =1.3.0, =5.1.0, =1.2.8, =1.2.8, =1.2.8, =1.2.8, =10.0.0, =10.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.1.1, =1.0.0, =1.17.2, =1.17.2, =1.20.2 and more Source cves: CVE-2026-41699https://vulners.com/cve/CVE-2026-4169...

com.apollographql.federation:federation-spring-subscription-callback (>=5.1.0, <=5.5.0), com.introproventures:graphql-jpa-query-test-boot-starter (>=1.2.8, <=1.2.15) +48 more potentially affected by CVE-2026-41700 via org.springframework.graphql:spring-graphql (>=1.3.0, <=1.3.7)

org.springframework.graphql:spring-graphql MAVEN version =1.3.0, =5.1.0, =1.2.8, =1.2.8, =1.2.8, =1.2.8, =10.0.0, =10.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.1.1, =1.0.0, =1.17.2, =1.17.2, =1.20.2 and more Source cves: CVE-2026-41700https://vulners.com/cve/CVE-2026-4170...

com.apollographql.federation:federation-spring-subscription-callback (>=5.1.0, <=5.5.0), com.introproventures:graphql-jpa-query-test-boot-starter (>=1.2.8, <=1.2.15) +48 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=1.3.0, <=1.3.7)

org.springframework.graphql:spring-graphql MAVEN version =1.3.0, =5.1.0, =1.2.8, =1.2.8, =1.2.8, =1.2.8, =10.0.0, =10.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.1.1, =1.0.0, =1.17.2, =1.17.2, =1.20.2 and more Source cves: CVE-2026-41856https://vulners.com/cve/CVE-2026-4185...

com.apollographql.federation:federation-spring-subscription-callback (>=5.1.0, <=5.5.0), com.introproventures:graphql-jpa-query-test-boot-starter (>=1.2.8, <=1.2.15) +48 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=1.3.0, <=1.3.7)

org.springframework.graphql:spring-graphql MAVEN version =1.3.0, =5.1.0, =1.2.8, =1.2.8, =1.2.8, =1.2.8, =10.0.0, =10.0.0, =9.0.0, =9.0.0, =9.0.0, =9.0.0, =9.1.1, =1.0.0, =1.17.2, =1.17.2, =1.20.2 and more Source cves: CVE-2026-41699https://vulners.com/cve/CVE-2026-4169...

com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2), com.graphql-java-generator:graphql-java-client-dependencies (>=3.0, <=3.1) +72 more potentially affected by CVE-2026-41700 via org.springframework.graphql:spring-graphql (>=1.4.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.4.0, =1.0.1, =3.0, =3.0, =3.0, =3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.6.0 and more Source cves: CVE-2026-41700 Source advisory: GHS...

com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2), com.graphql-java-generator:graphql-java-client-dependencies (>=3.0, <=3.1) +72 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=1.4.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.4.0, =1.0.1, =3.0, =3.0, =3.0, =3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.6.0 and more Source cves: CVE-2026-41856 Source advisory: GHS...

com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2), com.graphql-java-generator:graphql-java-client-dependencies (>=3.0, <=3.1) +72 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=1.4.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.4.0, =1.0.1, =3.0, =3.0, =3.0, =3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.6.0 and more Source cves: CVE-2026-41699 Source advisory: GHS...

com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2), com.graphql-java-generator:graphql-java-client-dependencies (>=3.0, <=3.1) +72 more potentially affected by CVE-2026-41700 via org.springframework.graphql:spring-graphql (>=1.4.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.4.0, =1.0.1, =3.0, =3.0, =3.0, =3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.6.0 and more Source cves: CVE-2026-41700 Source advisory: OSV...

com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2), com.graphql-java-generator:graphql-java-client-dependencies (>=3.0, <=3.1) +72 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=1.4.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.4.0, =1.0.1, =3.0, =3.0, =3.0, =3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.6.0 and more Source cves: CVE-2026-41856 Source advisory: OSV...

com.github.vzakharchenko:bridge-forge-connect (>=1.0.1, <=1.0.2), com.graphql-java-generator:graphql-java-client-dependencies (>=3.0, <=3.1) +72 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=1.4.0, <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.4.0, =1.0.1, =3.0, =3.0, =3.0, =3.0, =1.3.0, =1.3.0, =1.3.0, =1.3.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.2.0, =10.6.0 and more Source cves: CVE-2026-41699 Source advisory: OSV...

com.apollographql.federation:federation-spring-subscription-callback (>=6.0.0, <=6.2.1), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0, <=4.0.2) +53 more potentially affected by CVE-2026-41700 via org.springframework.graphql:spring-graphql (>=2.0.0, <=2.0.3)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0, =6.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter 1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources 1.4.0 -...

com.apollographql.federation:federation-spring-subscription-callback (>=6.0.0, <=6.2.1), com.graphql-java-generator.graphql-gradle-plugin3:com.graphql-java-generator.graphql-gradle-plugin3.gradle.plugin (>=4.0, <=4.0.2) +53 more potentially affected by CVE-2026-41856 via org.springframework.graphql:spring-graphql (>=2.0.0, <=2.0.3)

org.springframework.graphql:spring-graphql MAVEN version =2.0.0, =6.0.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0, =4.0.2 - com.introproventures:graphql-jpa-query-test-boot-starter 1.4.0 - com.introproventures:graphql-jpa-query-test-multiple-datasources 1.4.0 -...