CVE-2026-41699: Spring for GraphQL Deserialization RCE Vulnerability

Technical summary

CVE-2026-41699 is an unsafe deserialization vulnerability (CWE-502) in Spring for GraphQL triggered during processing of paginated GraphQL queries. The vulnerability allows unauthenticated remote attackers to achieve remote code execution by crafting a malicious request that exploits the deserialization of untrusted data within Connection (pagination) fields. Exploitation requires two conditions: the application must expose a paginated field, and specific exploitable classes must be present on the classpath (commonly found in Java applications that include certain libraries for XML processing, logging, or object serialization). The CVSS 3.1 score of 8.1 (HIGH) reflects high confidentiality, integrity, and authenticity impact, though it notes high attack complexity, likely due to the gadget class requirement.

Business impact

A successful exploit results in complete compromise of the affected application server, including theft of sensitive data, unauthorized code execution, lateral movement within the network, and potential disruption of service. Organizations running Spring for GraphQL in production without immediate patching face elevated risk of data breaches and operational disruption. The attack requires no authentication and can be triggered remotely over the network, making it exploitable from the internet if the GraphQL endpoint is exposed.

Affected systems

VMware Spring for GraphQL versions 1.3.0 through 1.3.8, 1.4.0 through 1.4.5, and 2.0.0 through 2.0.3 are affected. Organizations should identify all applications using Spring for GraphQL in these version ranges. The vulnerability manifests only when applications expose paginated (Connection) fields in their GraphQL schema, so review GraphQL type definitions to determine exposure.

Exploitability

The vulnerability is remotely exploitable without authentication and with high attack complexity. While an attacker must craft a request that exploits deserialization gadget chains (requiring knowledge of the classpath composition), the attack surface is broad: any paginated GraphQL field is a potential vector. The vulnerability has not been listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the source data date, but the technical nature suggests it will attract researcher attention. Organizations should assume exploitation is possible if the vulnerability remains unpatched.

Remediation

Upgrade Spring for GraphQL to patched versions: upgrade 1.3.x applications to 1.3.9 or later, upgrade 1.4.x applications to 1.4.6 or later, and upgrade 2.0.x applications to 2.0.4 or later (verify exact versions against the official VMware Spring for GraphQL security advisory). If immediate patching is not possible, disable or restrict access to paginated GraphQL endpoints, implement network-level access controls to limit GraphQL exposure, and review classpath dependencies to remove unnecessary gadget classes when feasible.

Patch guidance

VMware has released security patches for all affected version branches. Consult the official Spring for GraphQL security advisory for precise patch versions and verify compatibility with your application before deploying to production. Test patched versions in a staging environment to ensure no breaking changes to your GraphQL schema or queries. Priority should be given to patching version 2.0.x in active production use, followed by 1.4.x, then 1.3.x.

Detection guidance

Monitor for GraphQL requests targeting paginated (Connection) fields with unusual or malformed pagination parameters. Look for requests containing serialized Java object data or suspicious encoding patterns in variables or query arguments. Enable Spring Framework and GraphQL library logging at DEBUG level to capture deserialization events. Network-level detection can flag requests to GraphQL endpoints that deviate from normal pagination patterns. Implement rate limiting on GraphQL endpoints to slow potential exploitation attempts.

Why prioritize this

This vulnerability combines high impact (remote code execution), unauthenticated access, and network reachability, placing it in the top tier of remediation priorities. Although attack complexity is rated as high due to gadget class requirements, Java applications commonly include libraries with exploitable gadget chains. The broad adoption of Spring Framework and GraphQL in modern applications means the attack surface is substantial. Immediate patching is strongly recommended.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects the severity: an attacker with network access and no privileges can achieve complete system compromise (high confidentiality, integrity, and authenticity impact). The 'high' attack complexity moderates the score slightly, reflecting the requirement for specific exploitable classes on the classpath, but this does not substantially reduce risk in practice since Java applications frequently include such dependencies. The CVSS vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H confirms that this is a critical remote code execution vulnerability requiring urgent remediation.

Frequently asked questions