Loading vulnerability…
Spring for GraphQL Controller Annotation Authorization Bypass
CVE-2026-41856 is an improper access control vulnerability in Spring for GraphQL annotation detection for @Controller data fetchers. In affected releases, annotation resolution can fail for methods defined through type hierarchies, including inherited methods in abstract classes or generic interfaces where bridge-method handling is involved. Consequently, method-security annotations used for authorization, such as @PreAuthorize or @Secured, may not be detected and can be silently ignored at runtime. Affected versions are 1.0.0 through 1.0.6, 1.3.0 through 1.3.8, 1.4.0 through 1.4.5, and 2.0.0 through 2.0.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote unauthenticated attacker may access GraphQL data fetchers or data that should be protected by method-level authorization. The reported CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), indicating high confidentiality impact without stated integrity or availability impact. Authorization failures may not be logged because the framework can treat the affected handler as having no applicable authorization annotation.
If you can’t patch tonight, do this now.
Apply the fixed release. Until upgrading is possible, enforce authorization at the GraphQL HTTP endpoint or another layer independent of affected controller method annotation resolution, restricting access to authenticated and authorized users. Avoiding affected controller inheritance patterns may reduce exposure but is not a substitute for patching.
Patch, then assume compromise.
Upgrade Spring for GraphQL to a fixed release: 2.0.4 for the 2.0.x branch, 1.4.6 for the 1.4.x branch, 1.3.9 for the 1.3.x branch, or 1.0.7 for the 1.0.x branch. The fix corrects bridged-method matching so security annotations inherited from parent classes and interfaces are resolved correctly. No configuration changes are required after upgrading.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.