CVE-2026-41728 Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections
Attackers can modify protected nested object properties via JSON Patch requests, bypassing Jackson read-only restrictions in Spring Data REST applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41728?
CVE-2026-41728 is a high-severity missing authorization vulnerability in Spring Data REST, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer.
Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Weakness: CWE-284
Which versions are affected by CVE-2026-41728?
10 open source packages ship an affected version, including org.springframework.data:spring-data-rest-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.data:spring-data-rest-core Maven | All versions to 3.7.19 | None |
org.springframework.data:spring-data-rest-core Maven | All versions to 3.7.19 | None |
org.springframework.data:spring-data-rest-core Maven | From 4.3.0 to 4.3.16 | None |
org.springframework.data:spring-data-rest-core Maven | From 4.3.0 to 4.3.16 | None |
org.springframework.data:spring-data-rest-core Maven | From 4.4.0 to 4.4.14 | None |
org.springframework.data:spring-data-rest-core Maven | From 4.4.0 to 4.4.14 | None |
4 more packages
org.springframework.data:spring-data-rest-core Maven | From 4.5.0 | 4.5.12 |
org.springframework.data:spring-data-rest-core Maven | From 4.5.0 | 4.5.12 |
org.springframework.data:spring-data-rest-core Maven | From 5.0.0 | 5.0.6 |
org.springframework.data:spring-data-rest-core Maven | From 5.0.0 | 5.0.6 |
Products include Vmware Spring Data Rest.
How do I fix CVE-2026-41728?
Upgrade org.springframework.data:spring-data-rest-core to a fixed version for your release line: 4.5.12 or 5.0.6.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-41728 being exploited?
There is no known exploitation of CVE-2026-41728 in the wild and no public exploit code.
Other vulnerabilities in Spring Data REST
- CVE-2026-41729 Spring Data REST SpEL Injection via Map Key in JSON Patch
- CVE-2026-47849 Spring Data REST allows mutation of identifier and version properties via JSON Patch
- CVE-2026-41730 Spring Data REST exposes persistence-layer internals in error responses
- CVE-2026-41837 Spring Data REST Querydsl integration exposes Jackson-hidden persistent fields as filter keys
- CVE-2021-22047 Exposure of Resource to Wrong Sphere in Spring Data REST
Sources
Also known as CLSA-2026-1790958488, GHSA-cv39-x4c6-hhp2, ROOT-APP-MAVEN-CVE-2026-41728.