Spring Security Advisories

RSS feed

Spring for GraphQL Information Exposure in GraphiQL support

HIGH | AUGUST 20, 2026 | CVE-2026-59288

Description

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website.

More precisely, an application is vulnerable when all the following are true:

  • the application has the GraphiQL endpoint enabled and exposed
  • a victim with an active session follows a malicious link to the GraphiQL page of the application

Affected Spring Products and Versions

Spring for GraphQL:

  • 2.0.0 - 2.0.4
  • 1.4.0 - 1.4.6
  • 1.1.0 - 1.3.9
  • 1.0.0 - 1.0.7

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.
Fix versionAvailability
2.0.5OSS
2.0.4.1Enterprise Support Only
1.4.7Enterprise Support Only
1.3.10Enterprise Support Only
1.0.8Enterprise Support Only

As a workaround, users who cannot upgrade can disable the bundled GraphiQL endpoint (spring.graphql.graphiql.enabled=false) and, if an interactive GraphQL explorer is still needed, serve a self-hosted or vendored copy of GraphiQL.

References

History

  • 2026-08-20: Initial vulnerability report published.

Reporting a vulnerability

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all