CVE-2026-41700: Cross-Site WebSocket Hijacking in Spring for GraphQL
Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.
Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the WebSocket transport in Spring for GraphQL applications to mitigate Cross-Site WebSocket Hijacking.
Spring for GraphQL (WebSocket transport) WebSocket transport = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41700?
CVE-2026-41700 has a severity score of 8.1, indicating a high level of risk.
How do I fix CVE-2026-41700?
To fix CVE-2026-41700, ensure that WebSocket transport is disabled or implement strict validation to safeguard against Cross-Site WebSocket Hijacking.
Who is affected by CVE-2026-41700?
CVE-2026-41700 affects applications using VMware Spring for GraphQL with WebSocket transport enabled.
What type of attack does CVE-2026-41700 enable?
CVE-2026-41700 allows attackers to perform Cross-Site WebSocket Hijacking, enabling arbitrary GraphQL operations with victim credentials.
When was CVE-2026-41700 published?
CVE-2026-41700 was published on June 11, 2026.