Cross-site Request Forgery (CSRF) Affecting org.springframework.graphql:spring-graphql package, versions [1.0.0, 2.0.5)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGSPRINGFRAMEWORKGRAPHQL-19267450
- published26 Aug 2026
- disclosed20 Aug 2026
- creditUnknown
Introduced: 20 Aug 2026
NewCVE-2026-59288 (opens in a new tab)How to fix?
Upgrade org.springframework.graphql:spring-graphql to version 2.0.5 or higher.
Overview
org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications
Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the GraphiQL process. An attacker can access confidential information by enticing a victim with an active session to follow a malicious link to the GraphiQL page, causing the victim's browser to send sensitive data to the attacker's website.
Note: This is only exploitable if the GraphiQL endpoint is enabled and exposed, and a victim with an active session visits a malicious link.
Workaround
This vulnerability can be mitigated by disabling the bundled GraphiQL endpoint (spring.graphql.graphiql.enabled=false) and, if an interactive GraphQL explorer is still needed, serving a self-hosted or vendored copy of GraphiQL.