CVE-2026-41717 Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding
Attackers can execute arbitrary code via SpEL injection in Spring Data MongoDB when using annotated queries with capture-all placeholders.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41717?
CVE-2026-41717 is a high-severity code injection vulnerability in Spring Data MongoDB, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.
Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.
Weakness: CWE-917
Which versions are affected by CVE-2026-41717?
10 open source packages ship an affected version, including org.springframework.data:spring-data-mongodb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.data:spring-data-mongodb Maven | All versions to 3.4.19 | None |
org.springframework.data:spring-data-mongodb Maven | All versions to 3.4.19 | None |
org.springframework.data:spring-data-mongodb Maven | From 4.0.0 to 4.3.16 | None |
org.springframework.data:spring-data-mongodb Maven | From 4.0.0 to 4.3.16 | None |
org.springframework.data:spring-data-mongodb Maven | From 4.4.0 to 4.4.14 | None |
org.springframework.data:spring-data-mongodb Maven | From 4.4.0 to 4.4.14 | None |
4 more packages
org.springframework.data:spring-data-mongodb Maven | From 4.5.0 | 4.5.12 |
org.springframework.data:spring-data-mongodb Maven | From 4.5.0 | 4.5.12 |
org.springframework.data:spring-data-mongodb Maven | From 5.0.0 | 5.0.6 |
org.springframework.data:spring-data-mongodb Maven | From 5.0.0 | 5.0.6 |
Products include Vmware Spring Data Mongodb.
How do I fix CVE-2026-41717?
Upgrade org.springframework.data:spring-data-mongodb to a fixed version for your release line: 4.5.12 or 5.0.6.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-41717 being exploited?
There is no known exploitation of CVE-2026-41717 in the wild and no public exploit code.
Other vulnerabilities in Spring Data MongoDB
Sources
Also known as CLSA-2026-1789286187, CLSA-2026-1789667915, CLSA-2026-1790002371, CLSA-2026-1790062789, CLSA-2026-1790097396, CLSA-2026-1790246710 and 9 more.