Vmware Spring for GraphQL up to 1.0.6/1.3.8/1.4.5/2.0.3 origin validation

Summaryinfo

A vulnerability labeled as problematic has been found in Vmware Spring for GraphQL up to 1.0.6/1.3.8/1.4.5/2.0.3. This issue affects some unknown processing. Such manipulation leads to origin validation. This vulnerability is uniquely identified as CVE-2026-41700. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Vmware Spring for GraphQL up to 1.0.6/1.3.8/1.4.5/2.0.3. Affected by this issue is an unknown part. The manipulation with an unknown input leads to a origin validation vulnerability. Using CWE to declare the problem leads to CWE-346. The product does not properly verify that the source of data or communication is valid. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

The advisory is shared for download at spring.io. This vulnerability is handled as CVE-2026-41700 since 04/22/2026. The exploitation is known to be easy. The attack may be launched remotely. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/11/2026).

Upgrading to version 1.0.7, 1.3.9, 1.4.6 or 2.0.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-36213). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Vmware

Name

• Spring for GraphQL

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.4.0
• 1.4.1
• 1.4.2
• 1.4.3
• 1.4.4
• 1.4.5
• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3

License

• commercial

Website

• Vendor: https://www.vmware.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion