Vulnerability intelligence

CVE-2026-41856

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

CVSS Score

7.5

High

EPSS — Exploit Probability

0.4%

Riskier than 27% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Jun 11, 2026 · latest Jun 11, 2026

Coverage timeline

Spring GraphQL patches address CVE-2026-41699 deserialization risk
securityonline.info · Jun 11, 2026