CVE-2026-41856

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

• CWE-284

• https://spring.io/security/cve-2026-41856Vendor Advisory

Published

Jun 11, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-41850Applications that evaluate user-supplied Spring Expression L…7.5
• CVE-2026-41851Applications which accept user-supplied Spring Expression La…7.5
• CVE-2026-41852A vulnerability in Spring Expression Language (SpEL) evaluat…5.3
• CVE-2026-41853Spring MVC and WebFlux applications are vulnerable to Multip…5.3
• CVE-2026-41854Due to incorrect host parsing, applications that rely on Uri…6.5
• CVE-2026-41855In an untrusted JMS environment, org.springframework.jms.sup…9.8
• CVE-2026-41857A compromised or malicious BOSH Director can execute arbitra…7.8
• CVE-2026-41858Weak Randomness / Insecure Cryptographic Primitive (CWE-338)…7.5
• CVE-2026-41859A network man-in-the-middle between nats-sync and the BOSH d…7.8
• CVE-2026-4186A vulnerability was determined in UEditor up to 1.4.3.2. Thi…3.5
• CVE-2026-41860CWE-326 in BOSH allows a local attacker to steal Basic-auth …8.8
• CVE-2026-41861Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metad…4.2