CVE-2026-41717: Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

High severity · published Jun 9, 2026

CVE-2026-41717

Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

8.1

CVSS

0.3%

EPSS

On KEV

Description

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder. Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 26% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Spring Data MongoDB · Spring

5.0.0 before 5.0.5.1; 4.5.0 before 4.5.11.1; 4.4.0 before 4.4.15; 4.3.0 before 4.3.17; 4.2.0 before 4.2.16; 4.1.0 before 4.1.15; +2 more · source: vendor, NVD

Affected product

Spring Data MongoDB

Spring

All Spring Data MongoDB CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-41717

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-41717

Vendor Advisory

https://spring.io/security/cve-2026-41717