CVE-2026-41696 Spring Data MongoDB Bind Parameter Literal Quoting Breakout
Attackers can inject malicious regex patterns via crafted parameters in Spring Data MongoDB queries, potentially leading to code execution or data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41696?
CVE-2026-41696 is a medium-severity code injection vulnerability in Spring Data MongoDB, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting.
Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Weakness: CWE-943
Which versions are affected by CVE-2026-41696?
10 open source packages ship an affected version, including org.springframework.data:spring-data-mongodb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.data:spring-data-mongodb Maven | All versions to 3.4.19 | None |
org.springframework.data:spring-data-mongodb Maven | All versions to 3.4.19 | None |
org.springframework.data:spring-data-mongodb Maven | From 4.0.0 to 4.3.16 | None |
org.springframework.data:spring-data-mongodb Maven | From 4.0.0 to 4.3.16 | None |
org.springframework.data:spring-data-mongodb Maven | From 4.4.0 to 4.4.14 | None |
org.springframework.data:spring-data-mongodb Maven | From 4.4.0 to 4.4.14 | None |
4 more packages
org.springframework.data:spring-data-mongodb Maven | From 4.5.0 | 4.5.12 |
org.springframework.data:spring-data-mongodb Maven | From 4.5.0 | 4.5.12 |
org.springframework.data:spring-data-mongodb Maven | From 5.0.0 | 5.0.6 |
org.springframework.data:spring-data-mongodb Maven | From 5.0.0 | 5.0.6 |
Products include Vmware Spring Data Mongodb.
How do I fix CVE-2026-41696?
Upgrade org.springframework.data:spring-data-mongodb to a fixed version for your release line: 4.5.12 or 5.0.6.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-41696 being exploited?
There is no known exploitation of CVE-2026-41696 in the wild and no public exploit code.
Other vulnerabilities in Spring Data MongoDB
Sources
Also known as CLSA-2026-1789582244, CLSA-2026-1791290050, GHSA-hc43-m36c-8v33.