CVE-2026-41717: Spring Data MongoDB SpEL Expression Injection Vulnerability
Summary
CVE-2026-41717: Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection. Affects org.springframework.data:spring-data-mongodb across 5 version ranges.
< 3.4.19
>= 4.0.0, <= 4.3.16
>= 4.4.0, <= 4.4.14
>= 4.5.0, < 4.5.12
>= 5.0.0, < 5.0.6
Fixed in 3.4.19, 4.5.12 or 5.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Data MongoDB is a powerful framework that simplifies the integration of MongoDB with Spring applications. It provides a repository abstraction, allowing developers to interact with MongoDB databases using Java objects. The framework supports various features such as query derivation, pagination, and auditing. However, it is susceptible to a SpEL (Spring Expression Language) expression injection vulnerability, which can compromise the security of applications using affected versions.
Vulnerability Detail
The vulnerability arises during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. This allows an attacker to inject malicious SpEL expressions, potentially leading to unauthorized access to sensitive data or execution of arbitrary code. The affected versions range from Spring Data MongoDB 5.0.0 through 5.0.5, and earlier versions down to 3.4.0, making a significant number of applications vulnerable to exploitation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.4.193.4.19 -
>= 4.5.0, < 4.5.124.5.12 -
>= 5.0.0, < 5.0.65.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using capture-all placeholders in your @Query annotations. Instead, specify exact parameters to prevent potential injection points. For example, instead of:
@Query("{ 'field' : ?0 }") public List<MyEntity>
findByField(String field);
Use:
@Query("{ 'field' : ?0 }") public List<MyEntity>
findByFieldExact(String field);
This limits the risk of injection until a proper update can be applied.
Conclusion
The SpEL expression injection vulnerability in Spring Data MongoDB poses a significant risk to applications using affected versions. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, implementing workarounds can provide temporary relief until an update can be applied.
See every vulnerability recorded for org.springframework.data:spring-data-mongodb →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
Affected versions include Spring Data MongoDB 5.0.0 through 5.0.5, 4.5.0 through 4.5.11, and earlier versions down to 3.4.0.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
SpEL (Spring Expression Language) is a powerful expression language for querying and manipulating objects at runtime. Its misuse can lead to injection vulnerabilities, allowing attackers to execute arbitrary code.
If immediate updates are not possible, implement the suggested workarounds to limit exposure to the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.data:spring-data-mongodb.
