Spring for GraphQL CVE-2026-41856: Overview of Authorization Bypass via Annotation Detection Failure in Type Hierarchies

Introduction

A silently failing authorization layer is arguably worse than having no authorization at all, because it creates a false sense of security while leaving data exposed. CVE-2026-41856 is that kind of failure. Spring for GraphQL's annotation detection fails to resolve security annotations on @Controller methods defined within type hierarchies, so @PreAuthorize, @Secured, and similar authorization checks are bypassed at runtime without any error or warning.

Spring for GraphQL is the official Spring integration for building GraphQL APIs in Java, developed jointly by the Spring team and the GraphQL Java team. Given Spring Boot's dominance in enterprise Java microservices, it is the default choice for organizations adding GraphQL endpoints to their Spring applications. The vulnerability has a CVSS 7.5 (High) score and affects every release branch from the project's initial 1.0.0 GA through the latest 2.0.3, so every production deployment was running an affected version until the June 10, 2026 patches.

Technical Information

Root Cause: Bridge Method Resolution Failure

The problem is in how Spring for GraphQL resolves annotations on @Controller data fetcher methods when those controllers sit in a Java type hierarchy, either extending an abstract class or implementing a generic interface.

When a Java class implements a generic interface, the compiler generates synthetic "bridge methods" to preserve polymorphism after type erasure. For example, if an interface declares User fetchUser(Long id) and a concrete class implements it, the compiler may generate a bridge method with erased parameter types that delegates to the actual implementation. Spring for GraphQL's HandlerMethod bridged method matching logic traces these bridge methods back to the original declarations, which is where the annotations live.

Before the patch, that logic did not correctly match the erased types of the bridged methods back to the interface or abstract class methods carrying the security annotations. So when Spring Security's @EnableMethodSecurity infrastructure asked "does this method have a @PreAuthorize annotation?", the framework answered "no", even when the annotation was clearly present on the interface or parent class method.

As documented in issue #1469, a hierarchy like this one would trigger the vulnerability:

interface UserController {
  User fetchUser(@Argument A arg1, @Argument B arg2);
}

abstract class AbstractUserController implements UserController {
  @Override
  public User fetchUser(Long arg1, C arg2) {
  }
}

class ConcreteUserController extends AbstractUserController {
}

When resolving the handler method for ConcreteUserController, the framework would fail to find the annotations on the parameters, and by extension the security annotations on the interface method, because bridged method resolution did not map back through the type hierarchy correctly.

Three Required Conditions

The Spring advisory states that a Spring for GraphQL application is vulnerable only when all three of these conditions are true:

1. Spring Security is on the classpath. Most production Spring Boot applications meet this condition.
2. The application uses @EnableMethodSecurity, which turns on method-level security and is required for annotation-based authorization on data fetchers.
3. @Controller classes sit within a type hierarchy, extending other classes or implementing interfaces. This is what sends resolution down the failing path.

If any one of these is absent, the vulnerability is not triggered. The first two are extremely common in enterprise Spring Boot deployments, so the third is what decides whether an application is actually exposed.

CVSS Vector Breakdown

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, which breaks down as:

The vulnerability is classified under CWE-284: Improper Access Control, a pillar-level weakness covering failures to enforce access control.

Attack Flow

An attacker would exploit this vulnerability in this sequence:

1. Identify a Spring for GraphQL endpoint, typically exposed at a path like /graphql. If introspection is enabled, GraphQL introspection queries can reveal the schema, including data fetchers that would normally require authorization.
2. Send ordinary GraphQL queries to data fetchers backed by @Controller methods within type hierarchies. These are the methods where annotations like @PreAuthorize("hasRole('ADMIN')") would normally gate access.
3. Because the security annotations are never resolved, Spring Security's method security interceptor never fires, and the data fetcher executes as if no authorization constraint existed.
4. Receive the full response from the data fetcher, including data that should have been restricted to authorized users only.

The attacker never has to defeat authentication, because the authorization layer silently fails to engage. That makes the bug particularly dangerous: application logs and monitoring may show no authorization failures at all, since from the framework's perspective no authorization check was configured on the endpoint.

Co-occurring Vulnerabilities

The same release cycle patched two other Spring for GraphQL vulnerabilities:

An unpatched deployment may face authorization bypass, remote code execution through deserialization, and session takeover through WebSocket hijacking at the same time.

Patch Information

On June 10, 2026, the Spring team released versions that fix CVE-2026-41856. Brian Clozel (bclozel) wrote the fix, and it was backported to all supported branches.

The official Spring advisory lists these fixed versions:

The fix corrects the HandlerMethod bridged method matching logic so that it walks the inheritance chain and resolves annotations on methods declared in parent classes and interfaces, including when type erasure has produced bridge methods. Upgrading requires no configuration changes.

Version 1.4.6 is marked as the last open-source release of the 1.4.x generation, and the 2.0.x line is now the actively maintained OSS branch. Users on the older 1.3.x or 1.0.x lines will need a Tanzu Spring commercial support subscription to get their patches.

Bofei Chen responsibly disclosed the vulnerability.

Important note: The GitHub Advisory (GHSA-phxq-526m-79px) lists the patched versions as "Unknown" in the Dependabot ecosystem, so automated dependency update tools may not flag this CVE yet. Organizations should not rely on Dependabot alone and should check their Spring for GraphQL version manually.

Additional Mitigation Considerations

For organizations that cannot upgrade right away:

• Apply HTTP URL security as a defense-in-depth layer. The Spring GraphQL security documentation states that "the path to a Web GraphQL endpoint can be secured with HTTP URL security to ensure that only authenticated users can access it." This cannot tell apart different GraphQL requests on a shared endpoint, but it is a coarse-grained barrier that limits exploitation to authenticated users.
• Restructure controller hierarchies. Because the vulnerability requires @Controller classes within type hierarchies, restructuring controllers to avoid inheritance could serve as a temporary workaround. It does not replace patching.
• Patch all three co-occurring CVEs. CVE-2026-41699 and CVE-2026-41700 were fixed in the same release, so organizations should upgrade once and address all three together.

The Spring team has not published an official workaround.

Affected Systems and Versions

The vulnerability affects every Spring for GraphQL release from the project's initial GA up to the patched versions:

• Spring for GraphQL 2.0.0 through 2.0.3
• Spring for GraphQL 1.4.0 through 1.4.5
• Spring for GraphQL 1.3.0 through 1.3.8
• Spring for GraphQL 1.0.0 through 1.0.6

A deployment is vulnerable only when all three conditions are met:

1. Spring Security is present on the classpath
2. The application uses @EnableMethodSecurity for authorization
3. @Controller classes are implemented within type hierarchies (extending abstract classes or implementing interfaces)

Applications that do not use Spring Security, do not use method-level security annotations, or define all controller methods directly on concrete classes without inheritance are not affected.

Vendor Security History

Spring has a recurring record of annotation detection failures, alongside other notable vulnerabilities:

The CVE-2025-41248 and CVE-2025-41249 pair is particularly relevant. Those vulnerabilities affected Spring Security 6.4.0 through 6.4.9 and 6.5.0 through 6.5.3, and they were the same class of failure. The framework did not detect method-level security annotations, which led to authorization bypass and exposure of sensitive data. Seeing the pattern in Spring Security and now in Spring for GraphQL suggests a systemic problem in how the Spring ecosystem resolves security metadata in complex class hierarchies.

Broadcom's June 2026 update, described as the largest Spring security update ever, signals institutional investment in security. Still, CVE-2026-41856 affects every version from 1.0.0 onward, which shows that even well-maintained frameworks can carry latent security defects for years before anyone discovers them.

Threat Intelligence

As of June 11, 2026, there is no confirmed evidence that CVE-2026-41856 is being actively exploited in the wild. The CVE does not appear in the CISA Known Exploited Vulnerabilities Catalog, and no public proof-of-concept exploit code has been identified.

Several factors still warrant attention:

• The CVSS attack complexity is Low and no privileges are required, so exploitation is straightforward once someone identifies a vulnerable endpoint.
• Spring's dominance in enterprise Java makes it a high-value target, and Spring4Shell showed that threat actors weaponize Spring vulnerabilities quickly.
• Exploitation windows in other ecosystems have been shrinking sharply. CVE-2026-33626 in LMDeploy was exploited within 12 hours of disclosure.
• The 2026 VulnCheck Exploit Intelligence Report found that while only about 1% of 2025 CVEs were exploited in the wild, Spring-related CVEs have historically exceeded this average because of their wide deployment surface.

No threat actor has been linked to this vulnerability so far. Organizations should monitor threat intelligence feeds and the CISA KEV catalog for updates.

References

• CVE-2026-41856: Spring GraphQL Annotation Detection Vulnerability (Official Advisory)
• GitHub Advisory GHSA-phxq-526m-79px
• Spring for GraphQL 1.4.6 and 2.0.4 Released (Patch Announcement)
• Spring for GraphQL v2.0.4 Release
• Spring for GraphQL v1.4.6 Release
• GitHub Issue #1469: Annotation Resolution in Type Hierarchies
• Spring GraphQL Security Patches (SecurityOnline)
• CWE-284: Improper Access Control
• Security :: Spring GraphQL (Official Documentation)
• Broadcom Bolsters Spring Security with Largest Update Ever (Techzine)
• CVE-2025-41248 and CVE-2025-41249: Vulnerabilities in Spring Framework (SOC Prime)
• Spring for GraphQL Project Page
• Spring Security Advisories
• CISA Known Exploited Vulnerabilities Catalog
• Tanzu Spring Commercial Support