CVE-2026-41728: Spring Data REST Auth Bypass Vulnerability

CVE-2026-41728 Overview

CVE-2026-41728 is a broken access control vulnerability [CWE-284] in Spring Data REST's JSON Patch implementation. The application/json-patch+json handler fails to apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Attackers can modify fields that should be restricted by traversing nested object paths through the patch operation. The vulnerability affects multiple Spring Data REST release branches from 3.7.0 through 5.0.5.

Critical Impact
Unauthenticated network attackers can tamper with protected resource fields by crafting JSON Patch requests that target intermediate object segments, bypassing field-level write protection.

Affected Products

Spring Data REST 3.7.0 through 3.7.19
Spring Data REST 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, and 4.5.0 through 4.5.11
Spring Data REST 5.0.0 through 5.0.5

Discovery Timeline

2026-06-10 - CVE-2026-41728 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41728

Vulnerability Analysis

Spring Data REST exposes JPA repositories as HTTP resources and supports partial updates through the JSON Patch standard defined in RFC 6902. The framework includes a write-access filter that enforces which entity fields can be modified through REST requests. This filter is intended to block attempts to write to restricted properties such as audit fields, internal identifiers, or relationships marked read-only.

The defect occurs during JSON Pointer resolution. When a patch operation references a multi-segment path such as /owner/profile/email, the implementation evaluates write-access only against the terminal segment. Intermediate segments traversed during pointer resolution are not checked against the same filter. An attacker can use this gap to reach and modify properties that should be unreachable through the REST surface.

The vulnerability impacts integrity without affecting confidentiality or availability. Exploitation requires no authentication, no user interaction, and low attack complexity over the network.

Root Cause

The root cause is incomplete enforcement of authorization checks during pointer traversal [CWE-284]. The write-access filter validates the final field referenced by the JSON Pointer but does not recursively verify that every parent segment along the path is permitted. Logic that should apply consistently across the entire pointer chain runs only at the leaf.

Attack Vector

An attacker sends an HTTP PATCH request with the application/json-patch+json content type to an exposed Spring Data REST endpoint. The request body contains operations such as replace, add, or remove whose path value crosses through restricted intermediate properties. Because the filter does not evaluate those intermediate segments, the patch is applied and protected state is altered. Refer to the Spring Security advisory for CVE-2026-41728 for technical details on the affected code paths.

Detection Methods for CVE-2026-41728

Indicators of Compromise

HTTP PATCH requests with the application/json-patch+json content type targeting Spring Data REST endpoints under /api, /rest, or repository base paths.
Patch operations whose path contains multiple segments referencing nested associations or fields marked read-only at the domain layer.
Unexpected modifications to audit columns, ownership fields, or relationship references in entities exposed by Spring Data repositories.

Detection Strategies

Inspect application access logs for PATCH requests carrying JSON Patch payloads with multi-segment pointers and correlate with authenticated session context.
Enable Spring Data REST request logging at the DEBUG level for the org.springframework.data.rest package to surface patch payloads and resolved pointers.
Compare entity field changes against the application's documented write-access policy to identify writes to fields that should be immutable.

Monitoring Recommendations

Alert on JSON Patch requests whose path traverses entity boundaries the application does not expose for direct modification.
Track baseline rates of PATCH traffic per endpoint and flag deviations after deploying the patch.
Stream application and web server logs into a centralized analytics platform and pivot on user, source IP, and pointer depth.

How to Mitigate CVE-2026-41728

Immediate Actions Required

Upgrade Spring Data REST to a fixed maintenance release on the corresponding branch as listed in the Spring Security advisory.
Inventory all services that expose Spring Data REST repositories and validate which entities accept JSON Patch traffic.
Audit recent PATCH activity for evidence of writes to restricted fields and remediate any tampered records.

Patch Information

Upgrade to a Spring Data REST release that contains the fix for CVE-2026-41728. Affected branches are 3.7.x, 4.3.x, 4.4.x, 4.5.x, and 5.0.x. The vendor advisory at spring.io/security/cve-2026-41728 lists the fixed versions for each maintenance line.

Workarounds

Disable JSON Patch handling by rejecting the application/json-patch+json content type at a gateway or filter when patching is not required.
Restrict Spring Data REST exposure with @RepositoryRestResource(exported = false) on repositories or entities containing sensitive nested fields.
Enforce object-level authorization in controller advice or Spring Security method security to validate the full pointer path before the patch is applied.

bash

# Configuration example: restrict JSON Patch at the application layer
spring.data.rest.default-media-type=application/hal+json
# Reject json-patch requests via a Servlet filter or API gateway rule:
# if (Content-Type == application/json-patch+json) -> return 415