CVE-2026-59288 is a high severity information exposure in the GraphiQL page bundled with Spring for GraphQL. A victim with an active session who follows a malicious link might leak confidential information to the attacker's site. Fixed in 2.0.5, with enterprise fixes for older lines.
What's affected
- Product: Spring for GraphQL, versions 2.0.0 to 2.0.4, 1.4.0 to 1.4.6, 1.1.0 to 1.3.9 and 1.0.0 to 1.0.7.
- Fixed: 2.0.5 (open source). Enterprise Support only: 2.0.4.1, 1.4.7, 1.3.10 and 1.0.8.
- Exposed: applications with the GraphiQL endpoint enabled and exposed, where a user with an active session can be lured to a crafted link.
- Workaround from the advisory: disable the bundled GraphiQL endpoint or serve a self-hosted copy.
How to check if you're exposed
Find the Spring for GraphQL version your application resolves.
./mvnw dependency:tree -Dincludes=org.springframework.graphql
./gradlew dependencies --configuration runtimeClasspath | grep -i spring-graphql
Remember that Spring Boot manages this version for you in many projects, so check the resolved version rather than only your own build file.
Then check whether GraphiQL is switched on in each environment.
grep -rn "graphql.graphiql" src/main/resources
The property spring.graphql.graphiql.enabled controls the page. Check production configuration, environment variables and any config server, then request the GraphiQL path on a live instance to confirm what it serves.
What to do now
- Upgrade to Spring for GraphQL 2.0.5, or the enterprise fixed version for your line.
- Disable GraphiQL in production with spring.graphql.graphiql.enabled set to false.
- If you need it, serve a self-hosted copy and keep it behind authentication and on internal networks only.
- Use SameSite cookies and the HttpOnly flag, which limit what a malicious page can do with a session.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-200 (Exposure of Sensitive Information). The advisory explains that GraphiQL sends requests to your application's GraphQL endpoints, and that an attacker can craft a URL that makes the victim's browser leak confidential information to the attacker's website.
The attack needs the victim to be logged in and to click a link, which is why the record rates user interaction as required. The changed scope means the impact reaches beyond the vulnerable component. The record scores it 7.4 (High). It is one of four GraphQL advisories published together for this library; the others cover pagination deserialization, pagination denial of service, and CDN scripts. The record does not mark this CVE as exploited in the wild.
Quick check
Do I need GraphiQL in production?
Usually not. It is a development tool, and the advisory's own workaround is to disable it.
Sources
Last reviewed: 18 October 2026.
