CVE-2026-41856: Spring for GraphQL Annotation Resolution Authorization Bypass

Technical summary

Spring for GraphQL's annotation resolution mechanism for @Controller data fetchers does not consistently locate and apply security annotations when those annotations are declared on methods within inheritance hierarchies. The vulnerability stems from incomplete traversal or caching of method metadata during the annotation detection phase. When a data fetcher method inherits from a parent class or interface where authorization annotations are declared, or when annotations are applied at different levels of a type hierarchy, the framework may skip security checks that are critical to access control enforcement.

Business impact

This vulnerability creates a direct bypass of application-level authorization controls in GraphQL services built with Spring for GraphQL. An unauthenticated or under-privileged attacker can invoke protected data fetchers and access sensitive information or perform restricted operations if those operations rely solely on Spring's annotation-based security model. The impact is confidentiality and integrity compromise for any organization using affected versions with inheritance-based annotation patterns in their GraphQL resolvers.

Affected systems

Spring for GraphQL versions 2.0.0–2.0.3, 1.4.0–1.4.5, 1.3.0–1.3.8, and 1.0.0–1.0.6 are vulnerable. Any Spring-based GraphQL application using these versions and employing security annotations (such as @Secured, @PreAuthorize, or similar Spring Security mechanisms) on data fetcher methods within class hierarchies is at risk. Organizations should verify their dependency declarations and runtime classpath to determine exposure.

Exploitability

No known public exploit exists at this time. However, the vulnerability is straightforward to exploit once identified: an attacker simply calls a protected GraphQL query or mutation without proper credentials. The barrier to discovery is determining which data fetchers rely on annotation inheritance. Because this is a logic flaw rather than a code injection or memory corruption issue, exploitation requires no special tools or network conditions—standard GraphQL clients suffice. Organizations with public-facing GraphQL endpoints are at higher risk.

Remediation

Upgrade to patched versions immediately. Spring for GraphQL has released fixes in 2.0.4+, 1.4.6+, 1.3.9+, and 1.0.7+. Verify the exact patch version through the VMware Spring advisory. In the interim, apply defense-in-depth controls: centralize authorization logic outside of annotations, implement a Web Application Firewall (WAF) rule set for your GraphQL endpoint, and consider disabling public GraphQL introspection to reduce reconnaissance opportunities.

Patch guidance

Check the VMware Spring Security advisory for the specific patch versions available for your release line. Spring for GraphQL uses semantic versioning; you must upgrade to the next minor or patch version that is marked as containing the fix for this annotation resolution issue. Test thoroughly in a staging environment before deploying to production, particularly if your resolvers use method inheritance or interface-based data fetcher definitions. Verify that your security annotations are now being correctly recognized by enabling Spring Security debug logging.

Detection guidance

Monitor GraphQL query logs and Spring Security audit logs for successful authorization bypasses. Look for patterns: requests to previously restricted queries or mutations now succeeding without credential escalation, or repeated queries with missing authorization headers being accepted. Enable Spring Security's debug logging to confirm that @Secured and @PreAuthorize annotations are being evaluated on inherited methods. Use static analysis (e.g., SpotBugs or SonarQube with security rulesets) to identify data fetcher methods that declare security annotations in parent classes or interfaces.

Why prioritize this

This vulnerability scores 7.5 (HIGH) because it bypasses authentication/authorization controls with no user interaction required and affects confidentiality of sensitive data. While not yet in active exploitation in the wild, the conceptual simplicity and public disclosure of the issue mean opportunistic attacks are likely. Any GraphQL service handling sensitive operations (user data, financial records, or administrative functions) should treat this as urgent.

Risk score, explained

CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a score of 7.5. Attack Vector (N) indicates remote exploitation over the network; Attack Complexity (L) reflects the straightforward nature of calling a data fetcher; Privileges Required (N) and User Interaction (N) confirm no prerequisites. The impact is high confidentiality loss (C:H) because unauthorized access to protected data is the direct result, but integrity and availability remain unaffected.

Frequently asked questions