CVE-2026-41717: Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Synopsis

SpEL (Spring Expression Language) expression injection in Spring Data MongoDB affects applications that use @Query-annotated repository methods with capture-all parameter placeholders. The vulnerability is reachable over the network and requires no authentication, though exploitation depends on high-complexity conditions in the target environment. Successful exploitation gives an attacker full read, write, and denial-of-service capability against the affected service. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component must be reachable over the network; an attacker submits a crafted query parameter to an exposed HTTP or API endpoint that invokes an @Query-annotated repository method.

• AuthenticationNot required

  No credentials or session token are needed; the attacker can reach the injection point as an unauthenticated caller.

• Victim interactionNot required

  Exploitation is fully attacker-driven and does not require any action from a user or operator of the target application.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must account on environmental factors or specific application configuration (such as the presence of a capture-all placeholder in an @Query method) that are not guaranteed to be in place on every target.

Blast Radius

• Reads arbitrary data from the MongoDB database, including stored credentials, session tokens, and application records.
• Writes or modifies persisted database documents, enabling data tampering or injection of malicious records.
• Crashes or severely degrades the affected service, causing a denial of service for dependent applications and users.
• Depending on the SpEL evaluation context, the injected expression may access JVM internals or Spring application context beans, extending the attacker's reach beyond the database layer.