CVE-2026-41699 describes an unsafe deserialization vulnerability in Spring for GraphQL when handling paginated (Connection) fields in GraphQL queries. An attacker can exploit this by sending a maliciously crafted GraphQL request that triggers deserialization of untrusted data. Successful exploitation can lead to remote code execution, contingent on the presence of certain classes on the application's classpath that can be leveraged during deserialization. The affected versions include Spring for GraphQL 1.3.0 through 1.3.8, 1.4.0 through 1.4.5, and 2.0.0 through 2.0.3. No official patch or remediation level has been published yet.

Exploitation of this vulnerability can result in remote code execution, compromising confidentiality, integrity, and availability of affected systems. The attacker does not require privileges or user interaction but must be able to send crafted GraphQL queries to the vulnerable application. The impact is high due to the potential for full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing paginated (Connection) fields in GraphQL APIs or restrict access to trusted users only. Review classpath dependencies to minimize inclusion of classes that could be leveraged during deserialization. Monitor vendor channels for updates and apply official patches once released.