CVE-2026-41856

About vulnerability

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions.

Spring for GraphQL application are vulnerable when all the following are true:

• the application has Spring Security on the classpath
• the application relies on Spring Security’s @EnableMethodSecurity feature for security checks
• the application is implementing @Controller classes within type hierarchies

When all the conditions above are met, the security annotations can be ignored at runtime.

Affected product:

Spring

Affected packages:

Spring Boot @ 3.2.12 (+1136 more)