CVE-2026-41699 describes an unsafe deserialization vulnerability in Spring for GraphQL applications that process paginated (Connection) GraphQL queries. An attacker can exploit this by sending a specially crafted GraphQL request that triggers deserialization of untrusted data. If the application exposes a paginated field and the classpath contains exploitable classes, this can lead to remote code execution. The affected versions include Spring for GraphQL 1.3.0 through 1.3.8, 1.4.0 through 1.4.5, and 2.0.0 through 2.0.3. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation can result in remote code execution, compromising confidentiality, integrity, and availability of the affected system. This allows an unauthenticated attacker to execute arbitrary code remotely via crafted GraphQL queries, potentially leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing paginated (Connection) fields in GraphQL queries or restrict access to trusted users only. Review classpath dependencies to minimize inclusion of classes that could be leveraged during deserialization. Monitor vendor channels for updates and apply official patches once released.