CVE-2026-59288: Spring for GraphQL Information Exposure in GraphiQL support
Published Aug 27, 2026
·Updated
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7
Affected Software
1 affected component
Spring Spring for GraphQL>=2.0.0<=2.0.4, >=1.4.0<=1.4.6, >=1.1.0<=1.3.9, >=1.0.0<=1.0.7
Event History
Aug 27, 2026
CVE Published
via MITRE·05:57 PM
Data Sourced
via MITRE·05:57 PM
DescriptionWeakness
Data Sourced
via NVD·08:17 PM
Description