---
id: CVE-2026-41856
title: >-
  The Spring GraphQL annotation detection mechanism for @Controller data
  fetchers may not correctly resolve annotations on methods within type
  hierarchies
summary: >-
  The Spring GraphQL annotation detection mechanism for @Controller data
  fetchers may not correctly resolve annotations on methods within type
  hierarchies. This can be an issue if such annotations are used for
  authorization decisions. When…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-284
vendor: vmware
product: spring_for_graphql
affected:
  - 'spring_for_graphql >= 1.0.0, < 1.0.7'
  - 'spring_for_graphql >= 1.3.0, < 1.3.9'
  - 'spring_for_graphql >= 1.4.0, < 1.4.5.1'
  - 'spring_for_graphql >= 2.0.0, < 2.0.3.1'
patched:
  - spring_for_graphql 2.0.3.1
published: '2026-06-11'
updated: '2026-07-17'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41856'
references:
  - url: 'https://spring.io/security/cve-2026-41856'
    label: security@vmware.com
tags:
  - nvd
epss: 0.00352
epssPercentile: 0.28943
ingestedAt: '2026-07-17T21:16:24.439Z'
---

## Overview

The Spring GraphQL annotation detection mechanism for @Controller data fetchers may not correctly resolve annotations on methods within type hierarchies. This can be an issue if such annotations are used for authorization decisions. When all conditions are met, security annotations can be ignored at runtime.

Affected versions:
Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

## Affected

- `spring_for_graphql >= 1.0.0, < 1.0.7`
- `spring_for_graphql >= 1.3.0, < 1.3.9`
- `spring_for_graphql >= 1.4.0, < 1.4.5.1`
- `spring_for_graphql >= 2.0.0, < 2.0.3.1`

## Remediation

Upgrade past the affected range:

- `spring_for_graphql 2.0.3.1`