CVE-2026-41700: Cross-Site WebSocket Hijacking in Spring for GraphQL

Synopsis

Cross-Site WebSocket Hijacking (CSWSH) affects Spring for GraphQL when the WebSocket transport is enabled. An attacker reaches the vulnerability over the network, with no authentication required on their part, but must trick an authenticated user into visiting a malicious page. Successful exploitation lets the attacker execute arbitrary GraphQL operations using the victim's session credentials, giving the attacker full read and write access to whatever the victim's account can reach. Patched-image rebuilds at versions 1.0.7, 1.3.9, 1.4.6, and 2.0.4 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Spring for GraphQL WebSocket endpoint over the network; the service must be exposed to a network the attacker can send requests from.

• AuthenticationNot required

  The attacker does not need any account or credentials on the target application; they exploit the victim's already-authenticated session.

• Victim interactionRequired

  The attacker must socially engineer the authenticated victim into visiting a malicious page that initiates the cross-site WebSocket connection.

• Attack complexityDetail

  The exploit is reliable and imposes no special environmental conditions or race requirements; any authenticated user who visits the malicious page is vulnerable.

Blast Radius

• Reads any data the victim's GraphQL queries can return, including profile data, stored records, and session-scoped secrets.
• Executes mutations using the victim's credentials, allowing modification or deletion of persisted application data.
• Performs any GraphQL operation the victim's account is authorized for, which may include administrative actions depending on the application's authorization model.