CVE-2026-41697: Spring Data Relational SQLi Vulnerability

CVE-2026-41697 Overview

CVE-2026-41697 affects Spring Data Relational, including the JDBC and R2DBC modules. The framework fails to escape binding values when externally-controlled input is used with StringMatcher modes STARTING, ENDING, or CONTAINING in Query By Example (QBE). An attacker can supply SQL wildcard characters such as % and _ to perform boolean-based blind data inference against the underlying database. The flaw is categorized under CWE-943, Improper Neutralization of Special Elements in Data Query Logic.

Critical Impact
Attackers can infer sensitive database contents through wildcard injection in QBE string matchers, leading to unauthorized information disclosure.

Affected Products

Spring Data Relational/JDBC/R2DBC 4.0.0 through 4.0.5
Spring Data Relational/JDBC/R2DBC 3.5.0 through 3.5.11, 3.4.0 through 3.4.14, 3.3.0 through 3.3.16, 3.2.0 through 3.2.15
Spring Data Relational/JDBC/R2DBC 3.1.0 through 3.1.14, 3.0.0 through 3.0.15, and 2.4.0 through 2.4.19

Discovery Timeline

2026-06-10 - CVE-2026-41697 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41697

Vulnerability Analysis

Spring Data's Query By Example (QBE) feature allows developers to construct queries from a probe object combined with an ExampleMatcher. The StringMatcher enum controls how string properties are matched, with STARTING, ENDING, and CONTAINING translating to SQL LIKE predicates. The Relational module builds the LIKE pattern by concatenating user input with the appropriate wildcards but does not escape wildcard metacharacters already present in the input.

An attacker who controls the matched string can submit values containing % or _ to alter the predicate's matching behavior. By combining controlled wildcards with conditional response differences, the attacker performs boolean-based blind inference of adjacent data. The issue is network-reachable through any application endpoint that maps untrusted input into a QBE probe.

Root Cause

The defect originates in the QBE rendering logic for relational stores, which appends literal % or _ characters around the bound value without first escaping the same characters in the user-supplied string. Without an ESCAPE clause or sanitization, the database treats embedded metacharacters as wildcards rather than literals.

Attack Vector

Exploitation requires an application endpoint that accepts attacker-controlled input and uses it as a StringMatcher.STARTING, ENDING, or CONTAINING field within a QBE query. The attacker injects wildcard characters into the input, observes which queries return matching rows, and iteratively narrows candidate values for adjacent columns or rows. This is a blind data inference technique rather than full SQL injection, which limits direct execution but still permits exfiltration of sensitive fields. See the Spring Security advisory for additional technical detail.

Detection Methods for CVE-2026-41697

Indicators of Compromise

Repeated requests to the same endpoint with input containing % or _ characters in fields used by QBE.
Database logs showing high volumes of LIKE predicates with varying wildcard patterns against the same column.
Application access logs showing single-character permutations across many requests from one client.

Detection Strategies

Inspect application logs for query parameters that contain SQL wildcard characters in fields not normally expected to include them.
Enable database query auditing and alert on bursts of LIKE queries with progressively changing patterns.
Add WAF or input-validation rules that flag unescaped % or _ in request parameters bound to QBE search fields.

Monitoring Recommendations

Correlate inbound request rates with database read volume on endpoints backed by Spring Data Relational repositories.
Track error-rate and response-size deltas per endpoint, which often shift during blind inference campaigns.
Forward Spring Boot Actuator and database audit logs to a centralized analytics platform for longitudinal analysis.

How to Mitigate CVE-2026-41697

Immediate Actions Required

Upgrade Spring Data Relational, JDBC, and R2DBC to a fixed maintenance release on the active 4.0.x or 3.5.x line.
Audit application code for use of Example.of(...) combined with StringMatcher.STARTING, ENDING, or CONTAINING on externally-controlled fields.
Apply server-side validation to reject or escape % and _ characters in inputs bound to QBE string matchers.

Patch Information

Refer to the Spring Security advisory for CVE-2026-41697 for the authoritative list of fixed versions and upgrade instructions across the Spring Data Relational, JDBC, and R2DBC modules.

Workarounds

Replace QBE string matchers with explicit repository methods that bind parameters and apply server-side escaping for LIKE operators.
Pre-process attacker-influenced strings to escape %, _, and the escape character itself before constructing the probe object.
Restrict QBE-backed search endpoints with authentication, rate limiting, and input length caps to reduce inference feasibility.

bash

# Example input validation before constructing a QBE probe
# Reject inputs containing raw LIKE metacharacters
INPUT="$1"
if printf '%s' "$INPUT" | grep -q '[%_]'; then
  echo "Rejected: input contains SQL wildcard characters" >&2
  exit 1
fi