CVE-2026-41837: Spring Data REST Improper Access Control in Querydsl Filtering

Technical summary

Spring Data REST versions 3.7.0–3.7.19, 4.3.0–4.3.16, 4.4.0–4.4.14, 4.5.0–4.5.11, and 5.0.0–5.0.5 contain an improper access control vulnerability in the Querydsl integration. The vulnerability stems from the framework accepting arbitrary persistent property paths as request-parameter filter keys and passing them directly to Querydsl without first applying Jackson serialization filters, mixins, or custom property exclusion rules. This allows attackers to circumvent application-level property visibility controls and query object graph paths that developers intended to hide.

Business impact

Organizations running affected Spring Data REST versions expose sensitive data to unauthorized access through REST API queries. Depending on the application's data model, attackers could extract customer records, internal configuration, personally identifiable information, or other confidential properties. This breach of confidentiality can lead to regulatory penalties, loss of customer trust, and operational disclosure of sensitive business logic. The lack of authentication requirement (network-accessible APIs) significantly widens the attack surface.

Affected systems

Spring Data REST versions: 3.7.0–3.7.19; 4.3.0–4.3.16; 4.4.0–4.4.14; 4.5.0–4.5.11; 5.0.0–5.0.5. Applications using Spring Data REST's Querydsl filtering capabilities to expose repository endpoints via REST are vulnerable. Versions prior to 3.7.0 and any patched versions outside these ranges are not affected.

Exploitability

This vulnerability requires no authentication, no complex setup, and no user interaction—it can be exploited via a simple HTTP request with crafted filter parameters. An attacker with network access to the REST API can immediately begin probing and extracting data. The attack surface is large because Spring Data REST is commonly used in microservice architectures and cloud deployments. However, exploitation requires prior knowledge of the object model and property names, which somewhat limits automated mass exploitation.

Remediation

Update Spring Data REST to a patched version. Verify the exact patched version numbers with VMware's official Spring Data REST security advisory, as patch versions differ by release line. Alternatively, disable Querydsl filtering if it is not needed, or implement additional authorization filters in the application layer to restrict query-able properties. Review any logs for suspicious filter requests using unusual property paths post-disclosure.

Patch guidance

Consult VMware's official Spring Data REST security advisory to obtain the exact patched version numbers for each release line. After patching, perform smoke tests on REST endpoints that accept filter parameters to ensure filtering still functions correctly. In multi-module projects, ensure all transitive dependencies on Spring Data REST are updated consistently. Consider deploying to a staging environment first to validate compatibility with custom Jackson configurations.

Detection guidance

Monitor HTTP request logs for Querydsl filter parameters (typically found in query strings or request bodies) that reference unusual or deeply nested object properties, or properties known to be sensitive (e.g., password, secret, internal_id). Search for requests with filter syntax accessing properties that are not part of your API's documented schema. Implement WAF rules to block filter requests containing suspicious property paths. Review application startup logs to confirm the Spring Data REST version in use.

Why prioritize this

Although this vulnerability carries a CVSS 5.3 (Medium) score reflecting limited scope and confidentiality-only impact, it demands prompt attention because it is unauthenticated, network-exposed, and affects data confidentiality in a widely-used framework. The lack of KEV listing does not diminish the risk—many organizations rely on Spring Data REST, and the attack is trivial to execute once known. Prioritize patching production systems within 30 days, especially those handling sensitive customer or financial data.

Risk score, explained

The CVSS 5.3 score reflects an unauthenticated network attack (AV:N, PR:N), low attack complexity (AC:L), no user interaction required (UI:N), confidentiality impact in the availability boundary (C:L), and no integrity or availability impact (I:N, A:N). The score is elevated by the lack of authentication and ease of exploitation, but constrained by the fact that unauthorized information disclosure alone does not cause system-wide disruption or allow data modification.

Frequently asked questions