CVE-2026-41699: VMware Spring for GraphQL unsafe deserialization in paginated queries

CVE-2026-41699 · Severity: high · CVSS 8.1 · Published 2026-06-11

Spring for GraphQL is a framework that enables applications to serve GraphQL APIs using Spring. When an application exposes paginated query results (Connection fields) and has certain classes on its classpath, an unauthenticated attacker can send a specially crafted GraphQL request that triggers unsafe deserialization, leading to remote code execution. This allows complete compromise of the affected application without requiring any user interaction or special privileges.

Technologies: org.springframework.graphql:spring-graphql (Maven), VMware Spring for GraphQL. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41699 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41699 being exploited in the wild.
How severe is CVE-2026-41699?
High severity, with a CVSS score of 8.1, published 11 June 2026.
Which products and versions are affected?
org.springframework.graphql:spring-graphql (Maven) ECOSYSTEM:introduced=2.0.0,fixed=2.0.4; VMware Spring for GraphQL 2.0.0 through 2.0.3, 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.
Is there a fix for CVE-2026-41699?
Yes. org.springframework.graphql:spring-graphql (Maven): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41699 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41699?
Check whether you run org.springframework.graphql:spring-graphql (Maven) or VMware Spring for GraphQL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.graphql:spring-graphql (Maven): upgrade to 2.0.4 or later
    # set org.springframework.graphql:spring-graphql to 2.0.4 in your pom.xml or build.gradle

Technical details

This vulnerability is classified as unsafe deserialization (CWE-502) affecting the pagination (Connection) handling in Spring for GraphQL. The root cause involves improper validation of serialized objects during deserialization of GraphQL request variables. An attacker can craft a malicious GraphQL query with specially constructed variables that exploit this deserialization flaw. The attack requires network access to the GraphQL endpoint and does not require authentication, user interaction, or elevated privileges. Successful exploitation allows remote code execution with the privileges of the application. Patches are available: version 2.0.4, 1.4.6 for affected versions, though version 1.3.0–1.3.8 may have limited patching options.

Affected products

  • VMware Spring for GraphQL 2.0.0 through 2.0.3
  • VMware Spring for GraphQL 1.4.0 through 1.4.5
  • VMware Spring for GraphQL 1.3.0 through 1.3.8

Identifiers

  • CVE-2026-41699
  • GHSA-px92-q6rc-6mwv

Timeline

  • 2026-06-11: disclosed: Vulnerability published by GitHub Advisory Database
  • 2026-05-21: patched: Fix committed to upstream repository (commit 5579b6e)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.