CVE-2026-59286 is a high severity flaw in the GraphiQL page bundled with Spring for GraphQL. It loads JavaScript from a public CDN without Subresource Integrity checks. Fixed in 2.0.5, with enterprise fixes for older lines. Workaround: set spring.graphql.graphiql.enabled to false.
What's affected
- Product: Spring for GraphQL, versions 2.0.0 to 2.0.4, 1.4.0 to 1.4.6, 1.1.0 to 1.3.9 and 1.0.0 to 1.0.7.
- Fixed: 2.0.5 (open source). Enterprise Support only: 2.0.4.1, 1.4.7, 1.3.10 and 1.0.8.
- Exposed: applications with the GraphiQL endpoint enabled and reachable, where an attacker can also compromise the CDN or the network path to it.
- Workaround from the advisory: disable the bundled GraphiQL endpoint, and if you still want an interactive explorer, serve a self-hosted or vendored copy.
How to check if you're exposed
Find the Spring for GraphQL version your application resolves.
./mvnw dependency:tree -Dincludes=org.springframework.graphql
./gradlew dependencies --configuration runtimeClasspath | grep -i spring-graphql
Remember that Spring Boot manages this version for you in many projects, so check the resolved version rather than only your own build file.
Then check whether GraphiQL is on. In Spring Boot, look for the property that controls it.
grep -rn "graphql.graphiql" src/main/resources
If spring.graphql.graphiql.enabled is true, or set through an environment variable or config server, the page is served. Request the GraphiQL path on a running instance to confirm, and check that production profiles turn it off.
What to do now
- Upgrade to Spring for GraphQL 2.0.5 where you can.
- On older lines, ask for the enterprise fixed version, or disable GraphiQL.
- Set spring.graphql.graphiql.enabled to false in production profiles.
- If you need a query explorer, serve a self-hosted copy of GraphiQL with pinned, integrity checked assets.
- Treat the GraphiQL page as a development tool and keep it off internet facing deployments.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-494 (Download of Code Without Integrity Check). The page pulls its JavaScript libraries from a public CDN and does not use Subresource Integrity, so the browser cannot tell if the files have been changed.
Exploitation requires an attacker to first compromise something outside your application, either the CDN or the network path to it. If they do, the Spring advisory says the attacker can read cookies that lack the HttpOnly flag and send authenticated same-origin requests, including GraphQL operations. The record scores it 8.1 (High). The vector Spring links in its advisory differs from the record's: it shows a changed scope with high confidentiality and low integrity impact. So the sources give different scoring details for the same flaw. The record does not mark it as exploited in the wild.
Quick check
What is the quickest mitigation?
Turn GraphiQL off with spring.graphql.graphiql.enabled=false, or serve your own copy of the GraphiQL assets. Both come from the Spring advisory.
Sources
Last reviewed: 18 October 2026.
