Do Son 
TL;DR
VMware disclosed seven Spring GraphQL vulnerabilities and related Spring Cloud flaws on August 20, 2026. All rate as HIGH severity. The most serious, CVE-2026-59285, allows unsafe deserialization that can end in remote code execution. No exploitation in the wild or public proof-of-concept has been confirmed.
Why These Spring GraphQL Vulnerabilities Matter
Spring for GraphQL powers many production APIs built on the Spring stack. As a result, a single flaw can reach a large install base. Four issues sit inside Spring for GraphQL itself. Three more affect components in the Spring Cloud family.
The deserialization bug stands out. It can hand an attacker code execution on the server. The others risk denial of service, data leaks, and file access. Together they give defenders a busy patch cycle.
How the Attacks Work
CVE-2026-59285: Unsafe Deserialization
This flaw affects Spring for GraphQL 2.0.0 through 2.0.4. It triggers only under specific conditions. The app must expose a paginated Connection field and use Jackson 2.x. Its classpath must also carry gadget classes.
Pagination cursors are opaque strings that clients pass back. The cursor strategy deserializes that client-supplied value into a map. Because the cursor is attacker-controlled, a crafted request can name a dangerous class. Consequently, unintended logic runs and can reach remote code execution.
CVE-2026-59289: Denial of Service via Pagination
Auto-registered data fetchers forward client values straight to the repository. Therefore an attacker can forge a Connection query that drains memory. It can also pin heavy load on the datastore.
CVE-2026-59288 and CVE-2026-59286: GraphiQL Risks
The bundled GraphiQL page creates two problems. First, a malicious link can leak confidential information from an active session. Second, GraphiQL loads CDN scripts without Subresource Integrity checks. If the CDN is compromised, injected scripts can run in the victim browser.
Spring Cloud Flaws
Three Spring Cloud issues round out the batch. CVE-2026-59284 lacks an allow list for the writable env actuator endpoint. CVE-2026-47879 lets Spring Cloud Gateway read arbitrary resource locations for gRPC proto descriptors. Finally, CVE-2026-47836 exposes the Config Server to a TOCTOU race when cloning SVN repositories.
Affected Versions
Spring for GraphQL branches 2.0.x, 1.4.x, 1.3.x, 1.1.x, and 1.0.x are affected, depending on the CVE. The deserialization flaw hits only 2.0.0 through 2.0.4. Spring Cloud Commons, Gateway, and Config each list their own affected ranges across 3.1.x through 5.0.x.
Patch and Mitigation Steps
Upgrade first. Spring for GraphQL 2.0.5 is the OSS fix. Spring Cloud Commons 5.0.3, Gateway 5.0.3, and Config 5.0.5 ship the OSS patches for their modules.
If you cannot upgrade right away, apply workarounds. Disable the bundled GraphiQL endpoint with spring.graphql.graphiql.enabled=false. Set a valid-keys regex for the env actuator. Restrict Gateway proto descriptors with the valid-proto-descriptor-prefixes property. No extra step is needed for the SVN TOCTOU flaw beyond upgrading.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
