CVE-2026-41700

HighCVSS 8.1/10Last modified Jul 23, 2026

Description

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.

Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-346

Affected software

VendorProductVersions
SpringSpring for GraphQL>= 2.0.0, < 2.0.3.1; >= 1.4.0, < 1.4.5.1; >= 1.3.0, < 1.3.9; >= 1.0.0, < 1.0.7

References

Timeline

Published
Jun 11, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-417014.4Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counterCVE-2026-417027.0VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A maCVE-2026-417037.6VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could triggCVE-2026-417045.0AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads CVE-2026-417058.6Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. SprinCVE-2026-417066.1Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that usersCVE-2026-417077.4Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory containsCVE-2026-417087.5In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. TheCVE-2026-417092.7VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations CVE-2026-41716.3A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionaCVE-2026-417105.9An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retCVE-2026-417115.9Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsin