CVE-2026-41699: Unsafe Deserialization in Spring GraphQL

Synopsis

Unsafe deserialization in Spring for GraphQL allows a remote, unauthenticated attacker to achieve remote code execution by sending a crafted paginated GraphQL query. The vulnerability is reachable over the network without any credentials, though exploitation requires specific classes to be present on the application classpath and involves non-trivial conditions reflected in the high attack complexity rating. Successful exploitation gives the attacker full control over the host process, including the ability to read sensitive data, modify application state, and crash the service. A patched-image rebuild at versions 1.3.9, 1.4.6, or 2.0.4 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the GraphQL endpoint over the network; no local access or prior foothold is required.

• AuthenticationNot required

  No credentials or session token are needed to send the malicious paginated query.

• Victim interactionNot required

  The attacker triggers the vulnerability entirely through their own crafted request; no user action is needed.

• Attack complexityDetail

  Exploitation is non-trivial: the attacker must identify and target specific gadget classes on the application classpath to complete the deserialization chain.

Blast Radius

• The attacker executes arbitrary code inside the application's runtime process, gaining the same OS-level privileges as the container or service account.
• Confidential data accessible to the process, including environment variables, secrets, and in-memory session material, can be read and exfiltrated.
• The attacker can modify application state, write to mounted volumes, or alter persisted records reachable from the compromised process.
• The service can be crashed or rendered permanently unavailable by corrupting runtime state during deserialization.