CVE-2026-41856: Spring GraphQL Auth Bypass Vulnerability

CVE-2026-41856 Overview

CVE-2026-41856 affects Spring for GraphQL, where the annotation detection mechanism for @Controller data fetchers fails to correctly resolve annotations on methods within type hierarchies. When security annotations are placed on methods in parent classes or interfaces, the framework may not recognize them at runtime. Applications that rely on these annotations for authorization decisions can have their access controls silently ignored.

The flaw is classified under [CWE-284] Improper Access Control. It impacts confidentiality by allowing unauthorized data access through GraphQL endpoints when specific inheritance patterns are used in controller definitions.

Critical Impact
Authorization annotations on inherited data fetcher methods can be ignored at runtime, permitting unauthorized access to GraphQL query and mutation results.

Affected Products

Spring for GraphQL 2.0.0 through 2.0.3
Spring for GraphQL 1.4.0 through 1.4.5, and 1.3.0 through 1.3.8
Spring for GraphQL 1.0.0 through 1.0.6

Discovery Timeline

2026-06-11 - CVE-2026-41856 published to NVD
2026-06-11 - Last updated in NVD database

Technical Details for CVE-2026-41856

Vulnerability Analysis

Spring for GraphQL discovers data fetchers by scanning beans annotated with @Controller and inspecting methods for GraphQL-specific annotations such as @QueryMapping, @MutationMapping, and @SchemaMapping. The framework also reads security annotations on these methods to enforce authorization. The defect lies in how the annotation lookup traverses class hierarchies.

When a controller method overrides a parent class method, or implements an interface method, the annotation resolver may fail to locate annotations declared on the supertype. This results in security metadata being absent from the runtime invocation pipeline. The downstream authorization check never executes because it has no annotation to evaluate.

The network attack vector and lack of required privileges mean any unauthenticated client capable of reaching the GraphQL endpoint can submit queries that bypass intended controls. The flaw affects confidentiality without altering data integrity or availability.

Root Cause

The root cause is incomplete reflection-based annotation traversal in the Spring GraphQL controller scanning logic. Java reflection requires explicit walking of superclasses and interfaces to find inherited annotations on overridden methods. The affected versions perform this traversal incorrectly for certain inheritance configurations.

Attack Vector

An attacker sends a crafted GraphQL query to an exposed endpoint that targets a data fetcher method whose authorization annotation is declared on a parent type. The Spring GraphQL runtime resolves the method, fails to identify the security annotation, and executes the resolver without checking permissions. Sensitive fields are returned in the response.

No verified exploit code is published. Refer to the Spring Security advisory for CVE-2026-41856 for technical details from the maintainers.

Detection Methods for CVE-2026-41856

Indicators of Compromise

GraphQL queries returning fields that should require elevated roles, with no corresponding authentication context in access logs.
Anonymous or low-privilege session identifiers in /graphql request logs accessing administrative or restricted schema types.
Absence of authorization denial events for controllers known to declare @PreAuthorize or similar annotations on inherited methods.

Detection Strategies

Audit GraphQL controller source code for @Controller classes that inherit data fetcher methods from abstract classes or interfaces carrying security annotations.
Enable Spring Security debug logging to confirm whether authorization checks fire for each resolver invocation.
Compare expected versus actual access decisions during integration tests that exercise inherited resolver methods.

Monitoring Recommendations

Capture full GraphQL request and response bodies at the API gateway for retrospective analysis of unauthorized field access.
Alert on response payloads containing fields tagged as sensitive when the request principal is unauthenticated or below the required role.
Track Spring application version inventory and flag any deployments running affected Spring for GraphQL releases.

How to Mitigate CVE-2026-41856

Immediate Actions Required

Upgrade Spring for GraphQL to a fixed release line: 2.0.4 or later, 1.4.6 or later, 1.3.9 or later, or 1.0.7 or later, per the vendor advisory.
Inventory all @Controller beans that act as GraphQL data fetchers and identify methods inheriting security annotations from parents.
Move security annotations from supertypes onto the concrete controller method as a defensive measure until patches are deployed.

Patch Information

VMware/Spring released fixed versions across all supported branches. Consult the Spring Security advisory for CVE-2026-41856 for exact patched version numbers and release notes. Apply the patch matching the deployed branch and rebuild affected applications.

Workarounds

Redeclare authorization annotations such as @PreAuthorize, @Secured, or custom security annotations directly on the concrete @QueryMapping and @MutationMapping methods in the controller class.
Add a network-layer authorization filter in front of the GraphQL endpoint to enforce role checks independent of annotation discovery.
Disable or restrict GraphQL introspection on production endpoints to reduce attacker reconnaissance against vulnerable resolvers.

bash

# Example Maven dependency update to a fixed branch
./mvnw versions:use-dep-version \
  -Dincludes=org.springframework.graphql:spring-graphql \
  -DdepVersion=1.3.9 \
  -DforceVersion=true