Spring GraphQL Unsafe Deserialization in Paginated Queries

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a malicious GraphQL request that can lead to Remote Code Execution when the application exposes a paginated (Connection) field and the classpath contains specific classes that can be leveraged during deserialization. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Spring for GraphQL applications are vulnerable to unsafe deserialization when processing paginated GraphQL queries, a critical flaw affecting versions 1.3.0 through 2.0.3. When an application exposes a paginated Connection field, attackers can craft malicious GraphQL requests that exploit Java deserialization to achieve Remote Code Execution. This vulnerability matters because GraphQL has become a standard API layer for many enterprises, and the ability to chain pagination with gadget classes on the classpath creates a direct path to system compromise. Organizations running affected Spring for GraphQL versions—particularly those accepting external GraphQL queries—face immediate risk of data theft, lateral movement, and infrastructure takeover. The high CVSS score of 8.1 reflects the severity: no authentication is typically required, and successful exploitation grants the attacker code execution privileges equal to the application process.

Casky's 419 matching security skills, powered by Claude AI with extended reasoning, detect the attack patterns associated with this vulnerability by correlating three critical MITRE ATT&CK techniques: Initial Access (TA0001), Execution (TA0002), and Resource Development (TA0043). When practitioners analyze their findings, they'll see detection patterns that identify malicious GraphQL pagination payloads attempting to trigger unsafe deserialization, gadget class instantiation during request processing, and suspicious serialized Java objects within GraphQL connection arguments. Casky's skill set enables practitioners to recognize the specific indicators: abnormal GraphQL query structure targeting Connection types, presence of serialized object streams in pagination cursors, and attempts to instantiate dangerous classes like ProcessBuilder or Runtime through reflection. By mapping these attack patterns to MITRE techniques, practitioners gain visibility into reconnaissance activities (TA0043), initial compromise attempts (TA0001), and post-exploitation execution behaviors (TA0002), allowing them to implement targeted detection rules and prioritize patching of affected Spring for GraphQL versions in their environment.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-41699.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-41699

Casky has 419 skills that investigate the attack patterns behind CVE-2026-41699. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn