CVE-2026-41700

Overview

Spring for GraphQL is the official GraphQL integration for the Spring portfolio, building on GraphQL Java to let Spring applications expose GraphQL APIs over HTTP, WebSocket, and RSocket transports. Its WebSocket transport implements the GraphQL over WebSocket protocol so that clients can run queries, mutations, and long-lived subscriptions over a single WebSocket connection, and it is commonly enabled in applications that use GraphQL subscriptions.

A high-severity vulnerability (CVE-2026-41700) has been identified in Spring for GraphQL applications that have enabled the WebSocket transport. The GraphQL WebSocket handshake endpoint performed no Origin validation, so an application is vulnerable to Cross-Site WebSocket Hijacking when it has enabled the GraphQL WebSocket transport, relies on cookie-based session authentication, and does not have custom Spring Security WebSocket-level Origin enforcement configured. When all of those conditions are met, an attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.

Cross-Site WebSocket Hijacking is the WebSocket variant of Cross-Site Request Forgery (CSRF). Per OWASP, Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they're currently authenticated. Because browsers do not apply the same-origin policy to WebSocket connections and attach session cookies to the WebSocket handshake request, a page on any origin can open a WebSocket to the application with the victim's session unless the server validates the Origin header itself.

This issue affects >=1.0.0 <=1.0.6, >=1.2.0 <=1.2.9, >=1.3.0 <=1.3.8, >=1.4.0 <=1.4.5, and >=2.0.0 <=2.0.3 of Spring for GraphQL.

‍

Details

Module Info

• Product: Spring for GraphQL
• Affected packages: spring-graphql
• Affected versions: >=1.0.0 <=1.0.6, >=1.2.0 <=1.2.9, >=1.3.0 <=1.3.8, >=1.4.0 <=1.4.5, >=2.0.0 <=2.0.3
• GitHub repository: https://github.com/spring-projects/spring-graphql
• Published packages: https://central.sonatype.com/artifact/org.springframework.graphql/spring-graphql
• Package manager: Maven
• Fixed in:
• NES for Spring for GraphQL 1.0.x, 1.2.x, 1.3.x
• Spring for GraphQL 2.0.4, 1.4.6 (OSS)

Vulnerability Info

The vulnerability is in the GraphQL WebSocket transport handlers, GraphQlWebSocketHandler in the org.springframework.graphql.server.webmvc package and its reactive counterpart in org.springframework.graphql.server.webflux. These handlers accept the WebSocket handshake for the GraphQL endpoint and then execute the GraphQL operations sent over the connection.

The WebSocket handshake is a regular HTTP GET request, and browsers attach the application's session cookies to it even when the connection is initiated from a different origin. Unlike ordinary cross-origin HTTP requests, WebSocket connections are not restricted by the browser's same-origin policy, so it is entirely up to the server to reject handshakes coming from foreign origins by checking the Origin header. The Spring for GraphQL handlers performed no such check. In the WebMVC handler, initWebSocketHttpRequestHandler registered only a context-propagation interceptor and no OriginHandshakeInterceptor:

public WebSocketHttpRequestHandler initWebSocketHttpRequestHandler(HandshakeHandler handshakeHandler) {
    WebSocketHttpRequestHandler handler = new WebSocketHttpRequestHandler(this, handshakeHandler);
    handler.setHandshakeInterceptors(Collections.singletonList(this.contextHandshakeInterceptor));
    return handler;
}

‍
The WebFlux handler likewise exposed no CORS configuration and accepted handshakes from any origin.

As a result, a malicious page on any website could open a WebSocket to the application's GraphQL endpoint from the browser of a logged-in user. The handshake would carry the victim's session cookie, the server would accept the connection, and the attacker's page could then send arbitrary GraphQL queries, mutations, and subscriptions that execute with the victim's authenticated session, reading or modifying any data that session is authorized to access.

The remediation enforces a same-origin policy on the GraphQL WebSocket handshake by default. The WebMVC handler now prepends an OriginHandshakeInterceptor to the handshake chain, built from a CorsConfiguration that defaults to allowing no cross-origin callers, and the WebFlux handler now implements CorsConfigurationSource with the same deny-by-default configuration. Cross-origin handshakes are rejected with a 403 unless the application explicitly configures allowed origins through new constructor overloads that accept a custom CorsConfiguration.

This vulnerability was introduced in 2022 with Spring for GraphQL 1.0.

‍

Mitigation

Spring for GraphQL 1.0.x, 1.1.x, 1.2.x, and 1.3.x are End-of-Life open source lines and have no publicly available fix for this vulnerability.

Users of the affected components should apply one of the following mitigations:

1. Upgrade to a currently supported version of Spring for GraphQL that contains the fix. The OSS fix ships in Spring for GraphQL 2.0.4 (2.0.x line) and 1.4.6 (1.4.x line).
2. Leverage a commercial support partner like HeroDevs for post-EOL security support through Never-Ending Support (NES) for Spring for GraphQL, which delivers the fix on the 1.0.x, 1.2.x, and 1.3.x lines.