Brief Summary: CVE-2026-41700 Cross-Site WebSocket Hijacking in Spring for GraphQL

Introduction

Spring for GraphQL's WebSocket transport is missing an Origin validation check. As a result, any authenticated user who visits a malicious webpage can have their entire GraphQL session silently hijacked, and the attacker can then run arbitrary queries and mutations under the victim's identity. CVE-2026-41700 was published on June 11, 2026, as part of what has been called the largest coordinated Spring security update in the framework's 23-year history. It carries a CVSS 8.1 (HIGH) score and affects every major version line of Spring for GraphQL from 1.0.0 through 2.0.3.

Spring for GraphQL is the official Spring integration for GraphQL Java, built jointly by the GraphQL Java team and Spring engineering. It is the primary recommended way to build GraphQL services in the Spring ecosystem, so this vulnerability has broad potential reach across enterprise Java deployments worldwide.

Technical information

Root cause: missing Origin validation on the WebSocket handshake

CVE-2026-41700 is a Cross-Site WebSocket Hijacking (CSWSH) vulnerability. The weakness is formally classified as CWE-346 (Origin Validation Error) and, more specifically, CWE-1385 (Missing Origin Validation in WebSockets). CWE-1385 covers the case where "the product uses a WebSocket, but it does not properly verify that the source of data or communication is valid."

When a browser opens a WebSocket connection, it automatically includes the user's cookies for the target domain in the HTTP upgrade (handshake) request. This is a basic property of the browser WebSocket API. Unlike regular HTTP requests made with fetch or XMLHttpRequest, the WebSocket constructor does not let a page set custom headers during the handshake. The browser does, however, send an Origin header that identifies which site started the connection.

Spring for GraphQL does not validate this Origin header during the handshake. Any webpage, whatever its origin, can open a WebSocket connection to the GraphQL endpoint, and the server will accept it as legitimate.

CVSS breakdown

The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, which breaks down as follows:

Component	Value	Meaning
Attack Vector	Network	Exploitable remotely
Attack Complexity	Low	No special conditions beyond the three prerequisites
Privileges Required	None	Attacker needs no authentication
User Interaction	Required	Victim must visit a malicious page
Scope	Unchanged	Impact confined to the vulnerable component
Confidentiality	High	Full information disclosure possible
Integrity	High	Full integrity compromise possible
Availability	None	No direct availability impact

The C:H and I:H ratings mean an attacker can read any data the authenticated user can access and execute any GraphQL operation the user is authorized to perform.

Three prerequisites for exploitation

The Spring advisory says an application is vulnerable only when all three of the following conditions are true:

The application has enabled the GraphQL WebSocket transport. Spring for GraphQL supports both HTTP and WebSocket transports. Only deployments that use the WebSocket endpoint are affected.
The application relies on cookie-based session authentication. If authentication uses a mechanism the browser does not include automatically (such as an Authorization header with a bearer token), the cross-origin WebSocket handshake will not carry valid credentials.
Custom Spring Security WebSocket-level Origin enforcement is not configured. Spring Security provides ways to validate the Origin on WebSocket connections, but they are not enabled by default for the GraphQL WebSocket transport.

Attack flow

The attack has five stages:

Attacker prepares a malicious webpage. The page contains JavaScript that opens a WebSocket connection to the target Spring for GraphQL WebSocket endpoint (for example, wss://target-app.example.com/graphql).
Victim is lured to the malicious page. This can happen through phishing emails, social engineering, malicious advertisements, or cross-site scripting on an unrelated domain. The only requirement is that the victim has an active authenticated session with the target application.
Browser sends the WebSocket handshake with cookies. When the malicious JavaScript calls new WebSocket('wss://target-app.example.com/graphql'), the browser automatically attaches the victim's session cookies for target-app.example.com to the HTTP upgrade request.
Server accepts the cross-origin handshake. Spring for GraphQL does not validate the Origin header, so the server sees valid session cookies and opens the WebSocket connection as if the authenticated user had made a legitimate request.
Attacker executes arbitrary GraphQL operations. Over the open WebSocket, the attacker's JavaScript can send GraphQL queries, mutations, and subscription requests. Every operation runs with the victim's full authorization context, and the data the server returns flows back to the attacker's page.

As PortSwigger's documentation explains, "Cross-site WebSocket hijacking involves a cross-site request forgery vulnerability on a WebSocket handshake. It arises when the WebSocket handshake request relies solely on HTTP cookies for session handling."

Why standard CSRF protections do not stop it

Standard CSRF protections (such as anti-CSRF tokens in forms or the SameSite cookie attribute) do not automatically protect WebSocket handshakes. Because the WebSocket API does not support custom headers during the handshake, token-based CSRF defenses that depend on custom request headers cannot be applied the way they are for regular HTTP requests. The SecureFlag knowledge base notes that "the usual CSRF prevention may be implemented for the endpoint that serves the WebSocket (e.g., introducing a CSRF token)", but that takes explicit implementation, and the affected Spring for GraphQL versions did not have it.

Spring Security does support CSRF tokens for STOMP-based WebSocket connections (where "by default, Spring Security requires the CSRF token in any CONNECT message type"), but that protection was never extended to the GraphQL WebSocket transport.

Affected systems and versions

Four major version lines of Spring for GraphQL are affected:

Version Line	Affected Range	Fixed Version	Availability
2.0.x	2.0.0 through 2.0.3	2.0.4	Open source
1.4.x	1.4.0 through 1.4.5	1.4.6	Open source
1.3.x	1.3.0 through 1.3.8	1.3.9	Commercial (Enterprise support only)
1.0.x	1.0.0 through 1.0.6	1.0.7	Commercial (Enterprise support only)

That covers the entire release history of Spring for GraphQL. Unsupported versions are also considered affected.

As described above, an application is only exploitable if it (1) has enabled the GraphQL WebSocket transport, (2) uses cookie-based session authentication, and (3) has not configured custom Spring Security WebSocket-level Origin enforcement. Applications that use token-based authentication (such as bearer tokens in Authorization headers), or that already validate the Origin, are not vulnerable.

Vendor security history

Spring has had notable vulnerabilities before, most prominently Spring4Shell (CVE-2022-22965), which enabled remote code execution and was widely exploited. VMware published guidance on hunting for Spring4Shell and Java Spring vulnerabilities in 2022.

This CVE shipped alongside several other security fixes in what Techzine described as "the largest Spring security update ever" in the framework's 23-year history. The coordinated release also addressed CVE-2026-41699 (unsafe deserialization with RCE potential), CVE-2026-41856 (annotation detection weaknesses), CVE-2026-41843 (path traversal), and CVE-2026-22752 (authorization server issues).

At the same time, Broadcom announced expanded security investment, including SLSA Level 3 supply chain integrity and day-zero patch availability for Enterprise customers. That points to a systematic security review of the Spring portfolio. Organizations should expect more CVEs as the review continues, and should audit their Spring component inventory now, particularly features that use real-time transports (WebSocket, Server-Sent Events, RSocket), where Origin validation and CSRF protections may be missing in the same way.

CVE-2026-41700 belongs to a well-understood weakness class that OWASP and CWE have documented for years. Its presence indicates that basic security practices were not applied consistently when the GraphQL WebSocket transport was first developed.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information