CVE-2026-41856: Spring GraphQL Annotation Detection Vulnerability

Synopsis

An authorization-bypass vulnerability affects Spring for GraphQL in versions 1.0.0 through 2.0.3 across all supported release lines. The flaw is reachable over the network without any authentication, and stems from the annotation detection mechanism for @Controller data fetchers failing to correctly resolve security annotations on methods within type hierarchies. Successful exploitation allows an unauthenticated remote attacker to read data that should be protected by authorization controls. Patched-image rebuilds at versions 1.0.7, 1.3.9, 1.4.6, and 2.0.4 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable GraphQL endpoint must be reachable over the network; an attacker can send crafted requests without requiring physical or local access.

• AuthenticationNot required

  No credentials or session token are needed; the exploit is available to any unauthenticated caller who can reach the endpoint.

• Victim interactionNot required

  No user action is needed; the attacker sends requests directly to the service without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions such as race timing or specific memory layout.

Blast Radius

• An attacker reads data returned by @Controller data fetcher methods that were intended to be restricted by security annotations, bypassing access controls silently at runtime.
• Sensitive domain objects, query results, or business data exposed through the GraphQL schema can be retrieved without authorization.
• No data modification or service disruption is enabled by this vulnerability; impact is limited to confidentiality of the data accessible via unprotected fetcher methods.