CVE-2026-41717: Spring Data MongoDB SpEL Injection Remote Code Execution

Technical summary

CVE-2026-41717 is a SpEL (Spring Expression Language) injection vulnerability in Spring Data MongoDB's parameter binding mechanism. When a repository method is annotated with @Query and uses a capture-all placeholder, user-supplied input bound to that placeholder is evaluated as a SpEL expression rather than treated as literal data. This occurs across Spring Data MongoDB versions 3.4.0 through 5.0.5, allowing unauthenticated remote code execution in affected deployments. The vulnerability stems from unsafe expression evaluation during query construction and does not require prior authentication or special database access.

Business impact

Successful exploitation enables remote code execution within your application's JVM process. An attacker can read sensitive files, modify or delete database records, pivot to internal systems, establish persistence, or exfiltrate data. The impact extends beyond MongoDB; compromised applications become entry points for lateral movement within your infrastructure. Organizations relying on Spring Data MongoDB for data access are at risk unless running patched versions, particularly those processing untrusted input in query parameters or accepting externalized configuration.

Affected systems

VMware Spring Data MongoDB versions 3.4.0 through 5.0.5 are affected, spanning multiple maintenance branches. Organizations should inventory applications using Spring Data MongoDB and determine which versions are in use. This includes monolithic applications and microservices that depend on spring-data-mongodb as a transitive dependency. The vulnerability is only present in applications that (1) use @Query-annotated repository methods, and (2) pass user-controlled or external input to parameters bound by capture-all placeholders.

Exploitability

The vulnerability requires network access to the application (AV:N) but has high complexity (AC:H), suggesting barriers to exploitation such as application-specific input validation or filtering, though reliable exploitation techniques likely exist for many real-world configurations. No authentication is required (PR:N), and the attack does not depend on user interaction (UI:N). The complexity modifier suggests that exploitation depends on understanding the specific query structure and parameter binding in the target application, but once understood, it is reliably exploitable. No public exploit code or active exploitation has been documented at this time, though the attack surface is broad given the prevalence of Spring Data MongoDB in enterprise Java applications.

Remediation

Apply vendor security patches immediately. VMware will provide fixed versions for all affected release lines. Verify the exact patched version numbers in the official Spring Data MongoDB security advisory before deploying. In parallel, implement input validation and parameterization best practices: avoid dynamic query construction, use named parameters where possible, and treat all external input as untrusted. If you cannot patch immediately, disable or restrict access to affected repository methods and review logs for suspicious query patterns.

Patch guidance

Consult the official VMware/Pivotal Spring Data MongoDB security advisory for exact patched version numbers for each affected branch (3.4.x, 4.0.x, 4.1.x, 4.2.x, 4.3.x, 4.4.x, 4.5.x, and 5.0.x). Update spring-data-mongodb in your dependency management (Maven, Gradle) and perform full regression testing before production deployment. Spring Data MongoDB updates may be included in Spring Boot Bill of Materials (BOM) or Spring Cloud releases, so check your transitive dependencies. Prioritize patching applications in internet-facing or network-accessible tiers first.

Detection guidance

Search your codebase for @Query annotations combined with placeholder syntax, particularly capture-all patterns. Enable SpEL expression evaluation logging in Spring Data MongoDB if available. Monitor application logs for unusual SpEL expressions in query parameters—look for `T(`, `java.lang`, or system property access patterns in request logs. In network monitoring, watch for HTTP requests with encoded SpEL payloads (e.g., %7B%23 for {#). Database query logs may reveal suspicious query structures if expressions are evaluated before transmission. Correlate timing of unexpected code execution or system commands with inbound queries to affected repository methods.

Why prioritize this

CVE-2026-41717 merits immediate remediation due to its combination of high severity (CVSS 8.1), unauthenticated remote code execution, and broad applicability across Spring Data MongoDB user base. The vulnerability affects core data access patterns in Java applications and is not a niche edge case. Although exploit complexity is rated high, the control necessary to construct exploitation is within reach of skilled attackers with network access. Organizations should treat this as a critical patch for any internet-facing or internally-accessed applications using affected versions.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects unauthenticated remote access (AV:N, PR:N, UI:N) resulting in confidentiality, integrity, and availability compromise (C:H, I:H, A:H). The AC:H (High Complexity) modifier acknowledges that exploitation requires specific application configuration (use of @Query with capture-all placeholders) and possibly application-level validation bypass, but this does not significantly reduce the overall risk in environments where Spring Data MongoDB is heavily used with custom query methods. The unchanged (U) scope assumption indicates the impact is confined to the affected application itself.

Frequently asked questions