CVE-2026-41837: Spring Data REST Auth Bypass Vulnerability

CVE-2026-41837 Overview

CVE-2026-41837 affects Spring Data REST's Querydsl integration. The component accepts arbitrary persistent property paths as request-parameter filter keys. It also fails to consider Jackson customizations before passing them to Querydsl. This allows unauthenticated network attackers to query persistent properties that were never intended to be exposed through the REST API.

The vulnerability is classified under [CWE-284] Improper Access Control. Exploitation requires no privileges or user interaction. The impact is limited to confidentiality through unintended data exposure via filter parameters.

Critical Impact
Remote attackers can filter and infer values of internal entity properties that Jackson customizations were intended to hide, leading to information disclosure through the REST endpoints.

Affected Products

Spring Data REST 3.7.0 through 3.7.19
Spring Data REST 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, and 4.5.0 through 4.5.11
Spring Data REST 5.0.0 through 5.0.5

Discovery Timeline

2026-06-10 - CVE-2026-41837 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41837

Vulnerability Analysis

Spring Data REST exposes Spring Data repositories as hypermedia-driven REST resources. When Querydsl is on the classpath, Spring Data REST automatically binds request parameters to Querydsl predicates. This allows API clients to filter collection resources using query string parameters that map to entity properties.

The integration accepts any persistent property path supplied as a request parameter key. It does not restrict filtering to properties that the application has explicitly exposed. Jackson serialization customizations such as @JsonIgnore, @JsonProperty, or custom views are honored when serializing responses but are not consulted when building Querydsl predicates from request parameters.

An attacker can submit filter parameters that reference properties hidden from response bodies. By observing which records match a filter value, the attacker infers the underlying property values one query at a time. This enables boolean-style enumeration of sensitive fields such as password hashes, tokens, internal flags, or personal identifiers.

Root Cause

The root cause is a mismatch between the serialization layer and the query binding layer. Jackson annotations govern what clients see in responses. The Querydsl binder does not apply the same allow-list when translating request parameters into predicates. Persistent property paths that developers assumed were private remain reachable through filter expressions.

Attack Vector

The attack vector is the network. An attacker sends HTTP GET requests to a Spring Data REST collection resource and appends filter parameters referencing properties that should not be queryable. By varying the filter value and observing result set size or content, the attacker reconstructs hidden field values without ever reading them directly from a response body.

No authentication is required when the affected endpoint is publicly reachable. No code execution is provided to the attacker. See the Spring Security Advisory CVE-2026-41837 for additional technical details.

Detection Methods for CVE-2026-41837

Indicators of Compromise

Repeated HTTP GET requests against Spring Data REST collection endpoints that vary a single query parameter across many values, consistent with property-value enumeration.
Filter parameter names in access logs that match persistent properties annotated with @JsonIgnore or otherwise excluded from API responses.
Unusual volumes of requests against repository search and listing endpoints originating from a small number of source addresses.

Detection Strategies

Inventory Spring Data REST endpoints and compare the set of accepted Querydsl filter keys against the set of Jackson-exposed fields, flagging any divergence.
Add Web Application Firewall rules that reject filter keys referencing properties not on an explicit allow list for each repository resource.
Review application logs for HTTP 200 responses containing the same collection resource queried with high-cardinality variations of a single filter parameter.

Monitoring Recommendations

Alert on request rates against /rest/** or equivalent Spring Data REST base paths that exceed normal client behavior.
Capture and retain full request URIs for repository endpoints to enable retrospective analysis of property enumeration attempts.

How to Mitigate CVE-2026-41837

Immediate Actions Required

Upgrade Spring Data REST to a fixed release line above the affected ranges listed in the Spring Security Advisory CVE-2026-41837.
Audit each @RepositoryRestResource exposed by the application and define an explicit QuerydslBinderCustomizer that restricts bindings to fields intended for filtering.
Place authentication in front of Spring Data REST endpoints that are not designed for anonymous access.

Patch Information

Spring has released fixed versions addressing CVE-2026-41837. Consult the Spring Security Advisory CVE-2026-41837 for the exact patched versions and upgrade guidance corresponding to each affected branch.

Workarounds

Implement QuerydslBinderCustomizer for each repository to allow-list filterable properties and reject all others via bindings.excludeUnlistedProperties(true).
Use Spring Security or a reverse proxy to deny query parameters that reference sensitive property paths on Spring Data REST endpoints.
Disable the Querydsl integration where it is not required by removing querydsl dependencies or configuring repositories without QuerydslPredicateExecutor.

bash

# Example QuerydslBinderCustomizer restricting filterable properties
@Override
public void customize(QuerydslBindings bindings, QUser user) {
    bindings.excludeUnlistedProperties(true);
    bindings.including(user.username, user.active);
}