Spring Data MongoDB Expression Injection Vulnerability in User-Defined Queries
CVE-2026-41717

8.1HIGH

Key Information:

Vendor

Spring

Status
Spring Data Mongodb
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41717?

A vulnerability in Spring Data MongoDB allows for SpEL (Spring Expression Language) expression injection during parameter binding. This issue arises when user-defined repository query methods annotated with @Query utilize a capture-all placeholder. This could potentially allow malicious users to execute arbitrary expressions, impacting the integrity and security of the application. Developers should review their implementations and apply recommended mitigations.

Affected Version(s)

Spring Data MongoDB 5.0.0 < 5.0.5.1

Spring Data MongoDB 4.5.0 < 4.5.11.1

Spring Data MongoDB 4.4.0 < 4.4.15

References

https://spring.io/security/cve-2026-41717

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.