CVE-2026-41717: Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Q: What is the severity of CVE-2026-41717?

The severity of CVE-2026-41717 is rated as high with a score of 8.1.

Q: How do I fix CVE-2026-41717?

To fix CVE-2026-41717, update to a patched version of Spring Data MongoDB that addresses the SpEL expression injection vulnerability.

Q: What does CVE-2026-41717 affect?

CVE-2026-41717 affects Spring Data MongoDB, specifically in user-defined repository query methods annotated with @Query.

Q: What is the impact of CVE-2026-41717?

The impact of CVE-2026-41717 is defined by potential information disclosure and unauthorized access due to expression injection.

Q: Which versions of Spring Data MongoDB are vulnerable to CVE-2026-41717?

Spring Data MongoDB versions starting from 5.0.0 are vulnerable to CVE-2026-41717.

Published Jun 9, 2026

Updated

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.

Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

Affected Software

9 affected components

maven/org.springframework.data/spring-data-mongodb>=5.0.0<=5.0.5, >=4.5.0<=4.5.11, >=4.4.0<=4.4.14, >=4.3.0<=4.3.16, >=4.2.0<=4.2.15, >=4.1.0<=4.1.14, >=4.0.0<=4.0.15, >=3.4.0<=3.4.19

VMware Spring Data MongoDB>=3.4.0<3.4.20

VMware Spring Data MongoDB>=4.0.0<4.0.16

VMware Spring Data MongoDB>=4.1.0<4.1.15

VMware Spring Data MongoDB>=4.2.0<4.2.16

VMware Spring Data MongoDB>=4.3.0<4.3.17

VMware Spring Data MongoDB>=4.4.0<4.4.15

VMware Spring Data MongoDB>=4.5.0<=4.5.11.1

VMware Spring Data MongoDB>=5.0.0<5.0.5.1

Event History

Jun 9, 2026

CVE Published

via MITRE·11:48 PM

Data Sourced

via MITRE·11:48 PM

DescriptionSeverityWeakness

Jun 10, 2026

Data Sourced

via NVD·12:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-41717?

The severity of CVE-2026-41717 is rated as high with a score of 8.1.

How do I fix CVE-2026-41717?

To fix CVE-2026-41717, update to a patched version of Spring Data MongoDB that addresses the SpEL expression injection vulnerability.

What does CVE-2026-41717 affect?

CVE-2026-41717 affects Spring Data MongoDB, specifically in user-defined repository query methods annotated with @Query.

What is the impact of CVE-2026-41717?

The impact of CVE-2026-41717 is defined by potential information disclosure and unauthorized access due to expression injection.

Which versions of Spring Data MongoDB are vulnerable to CVE-2026-41717?