Information Disclosure Vulnerability in Spring for GraphQL by Pivotal
CVE-2026-59288

7.5HIGH

Key Information:

Vendor

Spring

Status
Spring For Graphql
Vendor
CVE Published:
27 August 2026

What is CVE-2026-59288?

The GraphiQL page included with Spring for GraphQL can inadvertently expose sensitive information through crafted URLs. When a user accesses these URLs, their browser may send confidential data to the attacker's domain, leading to a potential data leak. This issue impacts multiple versions of Spring for GraphQL, highlighting the need for developers to secure their endpoints and review their implementation of GraphQL features.

Affected Version(s)

Spring for GraphQL 2.0.0 <= 2.0.4

Spring for GraphQL 1.4.0 <= 1.4.6

Spring for GraphQL 1.1.0 <= 1.3.9

References

https://spring.io/security/cve-2026-59288

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.