CVE-2026-59288

Modified Modified - Updated After Analysis

Information Disclosure in Spring for GraphQL

Publication date: 2026-08-27

Last updated on: 2026-09-01

Assigner: VMware

Description

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-01

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-59288

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_for_graphql	From 1.4.0 (inc) to 1.4.7 (exc)
vmware	spring_for_graphql	From 2.0.0 (inc) to 2.0.4.1 (exc)
vmware	spring_for_graphql	From 1.0.0 (inc) to 1.0.8 (exc)
vmware	spring_for_graphql	From 1.1.0 (inc) to 1.3.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-59288 is a high-severity information exposure vulnerability in Spring for GraphQL's GraphiQL support. The GraphiQL page bundled with affected versions sends requests to the application's GraphQL endpoints. An attacker can trick a victim with an active session into following a malicious link, causing the victim's browser to leak confidential information to the attacker's website.

Detection Guidance

To detect this vulnerability, check if your Spring for GraphQL application is running an affected version (2.0.0-2.0.4, 1.4.0-1.4.6, 1.1.0-1.3.9, or 1.0.0-1.0.7). Verify if the GraphiQL endpoint is enabled by inspecting application properties or logs for `spring.graphql.graphiql.enabled=true`.

Impact Analysis

This vulnerability allows an attacker to obtain confidential information from a victim's browser session. If you use an affected version of Spring for GraphQL, an attacker could exploit this to steal sensitive data such as user credentials, personal information, or other confidential details processed by the GraphQL endpoints.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and potentially resulting in fines. For HIPAA, it may expose protected health information, leading to compliance violations and penalties. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies

Upgrade to fixed versions of Spring for GraphQL: 2.0.5 for OSS or enterprise support-only versions for others. As a temporary workaround, disable the bundled GraphiQL endpoint by setting spring.graphql.graphiql.enabled=false or use a self-hosted GraphiQL instance.

Hi! I’m here to help you understand CVE-2026-59288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70