Executive Summary

CVE-2026-41717 is a SpEL (Spring Expression Language) expression injection vulnerability found in Spring Data MongoDB.

The vulnerability occurs when a user-defined repository query method is annotated with @Query and uses a capture-all placeholder, such as @Query("?0") or @Query(":#{?0}").

If the application defines such a method, exposes it to untrusted input (for example, through Spring Data REST or a custom web endpoint), and passes unsanitized user input directly to this method, it becomes vulnerable to expression injection attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability has a high severity rating with a CVSS base score of 8.1, indicating it can have a significant impact.

An attacker can exploit this vulnerability to inject malicious SpEL expressions, potentially leading to unauthorized data access, data manipulation, or other harmful actions within the application.

Because it affects confidentiality, integrity, and availability (C:H/I:H/A:H), the impact can include data breaches, corruption, or denial of service.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability occurs when a user-defined repository query method in Spring Data MongoDB is annotated with @Query and uses a capture-all placeholder, and the method is exposed to unsanitized user input. Detection involves identifying such methods in your codebase and checking if they are exposed to untrusted input.

There are no specific network or system commands provided to detect this vulnerability directly.

To detect potential exploitation, you can review your application source code for @Query or @Aggregation annotations with capture-all placeholders (e.g., @Query("?0") or @Query(":#{?0}")) and verify if these methods are reachable from external inputs.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Spring Data MongoDB to a fixed version that addresses this vulnerability.

Additionally, ensure that any repository query methods annotated with @Query or @Aggregation do not accept unsanitized user input, especially if they use capture-all placeholders.

Restrict or validate inputs to these methods and avoid exposing them directly to untrusted sources such as Spring Data REST or custom web endpoints.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows injection of malicious Spring Expression Language (SpEL) expressions through unsanitized user input in certain query methods. Such an injection can lead to unauthorized data access, modification, or deletion, which may result in breaches of confidentiality, integrity, and availability of sensitive data.

Because of the potential for unauthorized access and manipulation of data, organizations using affected versions of Spring Data MongoDB without proper mitigation may risk non-compliance with data protection regulations such as GDPR and HIPAA, which mandate strict controls over personal and sensitive health information.

To maintain compliance, affected users should upgrade to fixed versions and ensure that user inputs are properly sanitized and validated to prevent exploitation of this vulnerability.

Useful 0 Not Useful 0