CVE-2026-41717: Spring Data MongoDB SpEL Injection Flaw

CVE-2026-41717 Overview

CVE-2026-41717 is a Spring Expression Language (SpEL) injection vulnerability affecting Spring Data MongoDB. The flaw occurs during parameter binding when a user-defined repository query method is annotated with @Query and uses a capture-all placeholder. An attacker who supplies crafted input to such a query method can inject SpEL expressions that the framework evaluates at runtime. Successful exploitation leads to arbitrary code execution within the application context.

The weakness is classified as [CWE-917] Improper Neutralization of Special Elements used in an Expression Language Statement. Spring published an advisory listing the affected version ranges across the 3.4.x, 4.0.x through 4.5.x, and 5.0.x release lines.

Critical Impact

Remote attackers can inject SpEL expressions through repository query parameters, leading to arbitrary code execution, data exfiltration, or full compromise of the Spring application.

Affected Products

• Spring Data MongoDB 5.0.0 through 5.0.5
• Spring Data MongoDB 4.5.0 through 4.5.11, 4.4.0 through 4.4.14, 4.3.0 through 4.3.16, 4.2.0 through 4.2.15, 4.1.0 through 4.1.14, 4.0.0 through 4.0.15
• Spring Data MongoDB 3.4.0 through 3.4.19

Discovery Timeline

• 2026-06-10 - CVE-2026-41717 published to NVD
• 2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41717

Vulnerability Analysis

Spring Data MongoDB lets developers define custom finder methods on repository interfaces using the @Query annotation. Inside these queries, developers can reference method parameters via positional placeholders such as ?0, ?1, or the capture-all placeholder ?#{...} which evaluates SpEL expressions. When a query uses a capture-all placeholder, the parameter binding layer passes untrusted input through the SpEL evaluator.

Because SpEL supports method invocation, type references, and constructor calls, an attacker who controls the bound parameter can craft an expression that executes arbitrary Java code. The evaluation runs with the privileges of the application process, giving the attacker the same access as the Spring application itself.

Root Cause

The root cause is the use of an unrestricted SpEL evaluation context during parameter binding for @Query methods that reference capture-all placeholders. Spring Data MongoDB did not neutralize or restrict expression syntax inside user-supplied parameter values before passing them to the SpEL parser. This matches the [CWE-917] pattern of expression-language injection.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction, although the attack complexity is high because exploitation depends on the target application exposing a vulnerable @Query method that consumes attacker-controlled input. A typical attack chain involves an HTTP endpoint that forwards request parameters into a repository call backed by a vulnerable annotated query. The attacker submits a parameter value containing a SpEL expression, the framework evaluates it during binding, and arbitrary code runs inside the JVM.

No verified public proof-of-concept code is referenced in the advisory. Refer to the Spring Security Advisory CVE-2026-41717 for vendor technical details.

Detection Methods for CVE-2026-41717

Indicators of Compromise

• HTTP request parameters or JSON bodies containing SpEL syntax fragments such as T(java.lang.Runtime), new ProcessBuilder, or #{...} reaching endpoints backed by Spring Data MongoDB repositories.
• Unexpected child processes spawned by the Java application process, particularly shells, curl, wget, or scripting interpreters.
• Outbound connections from the application server to unfamiliar hosts following requests to repository-backed endpoints.

Detection Strategies

• Perform static analysis of application source to inventory every @Query annotation that uses a capture-all placeholder and trace whether its parameters are reachable from untrusted input.
• Inspect web application firewall (WAF) and reverse proxy logs for SpEL signatures in query string values, form fields, and JSON properties bound to repository methods.
• Correlate application logs showing SpEL parse activity with concurrent process-creation or network-egress events on the host.

Monitoring Recommendations

• Enable verbose logging on the Spring Data MongoDB repository layer during incident review to surface expression evaluation events.
• Monitor the Java process for unexpected child processes, file writes outside the application working directory, and new outbound sockets.
• Aggregate application and host telemetry into a centralized analytics pipeline so SpEL-shaped payloads and post-exploitation activity can be correlated across layers.

How to Mitigate CVE-2026-41717

Immediate Actions Required

• Upgrade Spring Data MongoDB to a fixed release listed in the Spring Security Advisory CVE-2026-41717.
• Audit every repository interface for @Query methods that use capture-all placeholders and confirm none accept untrusted input until the upgrade is complete.
• Restrict outbound network egress from application servers to limit post-exploitation options if exploitation occurs before patching.

Patch Information

Spring has released patched versions on each maintained branch. Application owners should update Spring Data MongoDB to the latest patch release within their supported line (3.4.x, 4.0.x through 4.5.x, or 5.0.x) as directed by the vendor advisory. Rebuild and redeploy all services that include Spring Data MongoDB as a direct or transitive dependency.

Workarounds

• Rewrite affected repository methods to remove capture-all SpEL placeholders, using positional parameters such as ?0 instead.
• Validate and reject parameter values that contain SpEL syntax characters before they reach the repository layer.
• Place a WAF rule in front of vulnerable endpoints to block payloads containing T(, new , or #{ patterns until the patched version is deployed.

# Example Maven dependency pin to a patched release
# Replace <FIXED_VERSION> with the patched version from the Spring advisory
mvn versions:use-dep-version \
  -Dincludes=org.springframework.data:spring-data-mongodb \
  -DdepVersion=<FIXED_VERSION> \
  -DforceVersion=true