Spring for GraphQL CVE-2026-59285: Pagination RCE Risk

What to do

1. Find the resolved spring-graphql version in every service (mvn dependency:tree or gradle dependencyInsight).
2. Upgrade to Spring Boot 4.0.8 / 4.1.1 or later, or override spring-graphql.version to 2.0.5.
3. Check whether the app uses Jackson 2.x (com.fasterxml.jackson.core:jackson-databind) and exposes Connection fields; prioritize those services.
4. If an upgrade must wait, consider disabling or gating paginated fields for unauthenticated clients; Spring lists no official workaround.
5. Rebuild and redeploy; confirm the running artifact contains spring-graphql-2.0.5.jar or later.

How to check if you are affected or compromised

• Run ./mvnw dependency:tree -Dincludes=org.springframework.graphql:spring-graphql or ./gradlew dependencyInsight --dependency spring-graphql and compare against 2.0.5.
• Scan built JARs and SBOMs for spring-graphql-2.0.[0-4].jar.
• Review GraphQL request logs for unusual or oversized pagination cursor arguments (after/before) and for errors from JSON deserialization during paginated queries.

What happened#

On August 20, 2026, the Spring team published CVE-2026-59285, an unsafe deserialization flaw (CWE-502) in Spring for GraphQL's pagination support. Spring rates it High. The advisory says that when four conditions are all met, "an attacker can craft a malicious GraphQL request that can lead to Remote Code Execution". The conditions:

• the application uses Spring for GraphQL;
• it uses Jackson 2.x for JSON deserialization;
• it exposes a paginated (Connection) field;
• its classpath "contains specific classes that can be leveraged to execute unintended logic".

The fix is Spring for GraphQL 2.0.5, published to Maven Central the same day. A 2.0.4.1 build is available to Enterprise Support customers only. The CVE record went live on August 27. CISA's enrichment scores it CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N) and lists exploitation as "none" and automatable as "no". Spring has not published a credit, a proof of concept or the gadget classes involved.

Who is affected#

Only Spring for GraphQL 2.0.0 through 2.0.4. According to the project's versions table, that is the generation used by Spring Boot 4.0.x and 4.1.x. Boot's dependency management pins the version for you. Boot 4.0.7 and 4.1.0 manage 2.0.4, and Boot 4.0.8 and 4.1.1, released August 20, move to 2.0.5. Spring Boot 3.5.x uses Spring for GraphQL 1.4.x, which this advisory does not list as affected.

Do you really need to act?#

Only if your service matches every condition, and that is a real filter. "High complexity" in the score reflects the need for a usable gadget class on the classpath. Many applications won't have one, but large dependency trees often do, and you can't easily prove a negative. Work through it in this order:

• Spring Boot 3.x / Spring for GraphQL 1.x: not in the affected range. No action needed for this CVE.
• Boot 4 with no Connection fields in your schema: the vulnerable path is not exposed. Upgrade on your normal cycle.
• Boot 4, Connection fields and Jackson 2.x: treat this as an unauthenticated RCE candidate on any internet-facing GraphQL endpoint, and upgrade this week.

The upgrade itself is low risk. It is a patch release, and Spring says no further mitigation is needed once you are on a fixed version.

What to do now#

1. Find the resolved version: ./mvnw dependency:tree -Dincludes=org.springframework.graphql:spring-graphql or ./gradlew dependencyInsight --dependency spring-graphql.
2. Upgrade Spring Boot to 4.0.8 or 4.1.1 or later. If you can't move Boot yet, override the managed version: in Maven set <spring-graphql.version>2.0.5</spring-graphql.version> in <properties>; in Gradle set ext['spring-graphql.version'] = '2.0.5'.
3. Check which Jackson line your app uses for GraphQL JSON: ./mvnw dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind. Then search your schema for Connection types to rank services.
4. If a release has to wait, restrict paginated fields to authenticated callers at the gateway. Spring lists no workaround, so treat this as a stopgap only.
5. Rebuild, redeploy, and confirm the running artifact contains spring-graphql-2.0.5.jar or later.

How to tell if you were hit#

No exploitation has been reported, and no public exploit was known as of September 2. Spring has not published indicators. Look in GraphQL access logs for paginated queries with unusual or very long after/before cursor values, and for clusters of deserialization or type errors from those queries. Successful gadget-chain RCE usually shows up as the JVM process spawning shells or making unexpected outbound connections, so review EDR and egress logs for the GraphQL service.

Timeline#

• Jul 4, 2026 — CVE-2026-59285 reserved.
• Aug 20, 2026 — Spring publishes the advisory. Spring for GraphQL 2.0.5 and Spring Boot 4.0.8 and 4.1.1 are released to Maven Central.
• Aug 27, 2026 — The CVE record is published.
• Sep 2, 2026 — CISA adds its enrichment: CVSS 3.1 8.1, exploitation none.

Vulnerability records

• CVE-2026-59285 · Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Spring — CVE-2026-59285: Spring for GraphQL Unsafe Deserialization in pagination support spring.io
2. CVE record — CVE-2026-59285 cve.org
3. Maven Central — org.springframework.graphql:spring-graphql versions repo1.maven.org
4. Maven Central — spring-boot-dependencies 4.0.8 POM repo1.maven.org
5. Maven Central — spring-boot-dependencies 4.1.1 POM repo1.maven.org
6. Spring for GraphQL wiki — Spring for GraphQL Versions github.com
7. MITRE — CWE-502: Deserialization of Untrusted Data cwe.mitre.org