CVE-2026-41729: Spring Data REST SpEL Injection Flaw

CVE-2026-41729 Overview

CVE-2026-41729 is a Spring Expression Language (SpEL) injection vulnerability in Spring Data REST. The flaw exists in how the framework processes JSON Patch (application/json-patch+json) requests against persistent entities exposing map-typed properties. The JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without sanitization or validation, enabling authenticated attackers to inject arbitrary expressions [CWE-917].

Critical Impact
An authenticated attacker can submit a crafted JSON Patch request to execute arbitrary SpEL expressions, leading to high-impact compromise of confidentiality and integrity on affected Spring Data REST instances.

Affected Products

Spring Data REST 3.7.0 through 3.7.19
Spring Data REST 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11
Spring Data REST 5.0.0 through 5.0.5

Discovery Timeline

2026-06-10 - CVE-2026-41729 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41729

Vulnerability Analysis

Spring Data REST exposes persistent entities as HTTP resources and supports partial updates through JSON Patch operations defined in RFC 6902. When a persistent entity contains a Map-typed property, clients can address individual map entries using JSON Pointer syntax in the path field of a patch operation. The framework translates that pointer into a Spring Expression Language expression to navigate and modify the underlying object graph.

The translation step concatenates the path segment representing the map key directly into the SpEL expression string. The framework does not escape, validate, or restrict the characters allowed in the key segment. An attacker controlling the JSON Patch body can inject SpEL syntax that breaks out of the intended property accessor and evaluates arbitrary expressions in the application context.

Exploitation requires network access to a JSON Patch endpoint and low-privilege authentication. No user interaction is needed. Successful injection compromises confidentiality and integrity of the host application.

Root Cause

The root cause is unsafe string composition of a SpEL expression from untrusted input. The path segment derived from a JSON Pointer is treated as a literal key but is interpolated into expression source that the SpEL ExpressionParser later evaluates. This conflates data with code, the defining condition of expression language injection [CWE-917].

Attack Vector

The attacker sends an HTTP PATCH request with content type application/json-patch+json to a Spring Data REST resource backed by an entity exposing a map property. The patch body contains an op such as add or replace with a path value crafted so the map key segment includes SpEL metacharacters. When the framework parses the path and constructs the expression, the injected fragment is parsed as code and executed with the privileges of the application process.

The vulnerability manifests during expression construction inside Spring Data REST's JSON Patch handler. See the Spring CVE-2026-41729 Advisory for vendor-confirmed technical details.

Detection Methods for CVE-2026-41729

Indicators of Compromise

HTTP PATCH requests with Content-Type: application/json-patch+json containing unusual characters such as T(, #, ', or parentheses inside the path field key segments.
Application logs showing SpelEvaluationException or successful evaluation of expressions referencing types like java.lang.Runtime or java.lang.ProcessBuilder.
Outbound network connections or child process executions originating from the Spring application JVM shortly after JSON Patch traffic.

Detection Strategies

Inspect web access logs for JSON Patch requests targeting Spring Data REST endpoints and flag path values containing SpEL syntax characters.
Enable Spring Data REST and SpEL debug logging in non-production environments to surface malformed or rejected expressions during testing.
Correlate process creation telemetry on application hosts with preceding HTTP PATCH activity to identify expression-driven command execution.

Monitoring Recommendations

Alert on Java application processes spawning shells (sh, bash, cmd.exe) or scripting interpreters when the parent is a Spring Boot server.
Monitor for unexpected outbound connections from application servers immediately following PATCH traffic to REST resources.
Track HTTP 5xx error spikes on JSON Patch endpoints, which can indicate failed injection attempts.

How to Mitigate CVE-2026-41729

Immediate Actions Required

Upgrade Spring Data REST to a fixed version listed in the Spring CVE-2026-41729 Advisory for your release line.
Inventory all applications using Spring Data REST and identify entities exposing Map-typed properties through repository resources.
Restrict access to JSON Patch endpoints to authenticated, trusted clients until patches are applied.

Patch Information

Pivotal has released fixed versions across the affected branches. Upgrade beyond 3.7.19, 4.3.16, 4.4.14, 4.5.11, and 5.0.5 per the vendor advisory. Apply transitive dependency updates through Spring Boot or Spring Data BOMs to ensure consistency across modules.

Workarounds

Disable JSON Patch support on exposed repositories by removing application/json-patch+json from accepted content types.
Avoid exposing entities with Map-typed properties through Spring Data REST repositories until upgraded.
Deploy a Web Application Firewall (WAF) rule that rejects PATCH requests whose JSON Pointer path segments contain SpEL metacharacters such as T(, #, or unbalanced quotes.

bash

# Example Maven dependency override pinning a fixed Spring Data REST version
# Adjust the version to the patched release matching your branch
mvn dependency:tree | grep spring-data-rest