CVE-2026-41862: Spring Statemachine Kryo Deserialization RCE

Technical summary

The vulnerability stems from Kryo deserialization in Spring Statemachine's persistence layer (CWE-502). Kryo is a fast Java serialization framework, but it can instantiate arbitrary classes during deserialization unless an allowlist (known as a classloader filter or type mapping) is enforced. The affected versions apply Kryo to multiple storage backends without such controls. An authenticated user who can influence or inject persisted state-machine context data can cause the Kryo deserializer to instantiate malicious objects, triggering static initializers, constructors, or method calls that lead to remote code execution within the application JVM. The CVSS 3.1 score of 8.8 (HIGH) reflects the requirement for prior authentication (PR:L) but the complete compromise potential (C:H, I:H, A:H) and network accessibility (AV:N).

Business impact

Any application running Spring Statemachine 3.2.0–3.2.4 or 4.0.0–4.0.1 with persistence enabled faces the risk that a logged-in user or an attacker who gains user credentials can achieve remote code execution. This enables data theft, system compromise, lateral movement within the network, and potential supply-chain attacks if the compromised application is a service provider. Remediation requires either upgrading to patched versions or disabling Kryo-based persistence until a fix is deployed. Organizations should assess whether any critical workflows depend on persistence and prioritize patching accordingly.

Affected systems

Spring Statemachine 3.2.0, 3.2.1, 3.2.2, 3.2.3, 3.2.4, 4.0.0, and 4.0.1 are affected when configured with JPA, MongoDB, Redis, or ZooKeeper persistence backends. Applications that use Spring Statemachine for workflow management, order processing, or any stateful business logic with persistence are in scope. Versions prior to 3.2.0 and versions released after the patch (consult the Spring project release notes) are not affected.

Exploitability

Exploitation requires valid application credentials (authentication is enforced per the CVSS vector PR:L). There is no known public exploit code, and the vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog. However, the attack surface is accessible over the network if the application is exposed, and the technical barrier to crafting a Kryo payload is moderate for attackers familiar with Java serialization. Once credentials are compromised or if credential controls are weak, exploitation becomes practical. Internal threat actors with legitimate access pose a meaningful risk.

Remediation

Organizations should immediately update to patched versions released by the Spring project after 4.0.1 and 3.2.4. Verify the exact patched version numbers in the official Spring Security or Spring Statemachine advisory. As an interim control, disable Kryo-based persistence if the application permits; switch to alternative serialization backends or disable persistence entirely until patches are applied. Review access logs and persistence storage (databases, caches, queues) for signs of unauthorized state-machine context injection or deserialization errors.

Patch guidance

Check the Spring Statemachine release notes and security advisory for the earliest patched versions following 4.0.1 and 3.2.4. Apply patches in a controlled manner: test in staging first to confirm compatibility with your persistence backend (JPA, MongoDB, Redis, ZooKeeper). If you are on 3.2.x, verify the upgrade path to the patched 3.2.x version; if on 4.0.x, similarly check for a patched 4.0.x release. If no patched version exists in your minor release line, plan a minor or major version upgrade. Monitor application logs during and after patching for deserialization warnings or exceptions.

Detection guidance

Monitor application logs for Kryo deserialization errors, ClassNotFoundException, or SecurityException events related to persistence operations. Check for unusual activity following state-machine context restoration. Review authentication logs for failed or successful logins followed by state-machine mutations. In persistence layers (database, Redis, ZooKeeper), look for anomalous serialized objects or unexpected payload sizes in state-machine context records. Set up alerting on deserialization exceptions and track any process execution spawned by the application JVM after state-machine context loads. Network-based detection is difficult without deep packet inspection; focus on host and application logging.

Why prioritize this

This vulnerability merits immediate attention because it enables remote code execution within the application JVM—the highest-impact privilege escalation. Although it requires authentication, compromised credentials are common, and the persistence backends are often accessible in cloud or containerized deployments. The CVSS score of 8.8 and the breadth of affected versions (two minor release lines) justify urgent patching. Any organization running Spring Statemachine should determine within hours whether they are on an affected version.

Risk score, explained

The CVSS 3.1 score of 8.8 is HIGH because of the full confidentiality, integrity, and availability impact (C:H, I:H, A:H) and network-accessible attack vector (AV:N). The requirement for authenticated access (PR:L) prevents a CRITICAL rating, but in practice, credential compromise is frequent. The low attack complexity (AC:L) reflects that no special conditions or user interaction (UI:N) are needed once an attacker has valid credentials. The unchanged scope (S:U) means impact is confined to the affected application, not other systems—though lateral movement is often a follow-on risk.

Frequently asked questions