Spring for GraphQL 1.0-2.0.4 GraphiQL XSS/Info Leak via Malicious URL
CVE-2026-59288 Published on August 27, 2026
Spring for GraphQL Information Exposure in GraphiQL support
The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website.
Spring for GraphQL 2.0.0 - 2.0.4
Spring for GraphQL 1.4.0 - 1.4.6
Spring for GraphQL 1.1.0 - 1.3.9
Spring for GraphQL 1.0.0 - 1.0.7
Products Associated with CVE-2026-59288
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring for GraphQL:- Version 2.0.0, <= 2.0.4 is affected.
- Version 1.4.0, <= 1.4.6 is affected.
- Version 1.1.0, <= 1.3.9 is affected.
- Version 1.0.0, <= 1.0.7 is affected.