CVE-2026-41728: Spring Data REST JSON Patch bypasses Jackson read-only property protection on nested objects and collections

Synopsis

This is an authorization bypass vulnerability in Spring Data REST's JSON Patch implementation. An unauthenticated attacker can reach the affected service over the network and send a crafted PATCH request using a multi-segment JSON Pointer path, which causes the write-access filter to be skipped for intermediate path segments, allowing fields marked as read-only to be overwritten. Successful exploitation lets an attacker tamper with data that should be immutable, including nested objects and collections protected by Jackson's read-only annotations. Patched-image rebuilds at versions 3.7.20, 4.3.17, 4.4.15, 4.5.12, and 5.0.6 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Spring Data REST endpoint over the network and send HTTP PATCH requests to it.

• AuthenticationNot required

  No credentials or session token are needed; the malicious PATCH request can be sent by any unauthenticated caller.

• Victim interactionNot required

  No user action is required; the attacker sends the crafted request directly to the service without involving any other party.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: the attacker constructs a JSON Patch document with a multi-segment path and sends it, with no race conditions or special environmental state required.

Blast Radius

• An attacker overwrites fields on server-side domain objects that are explicitly marked read-only via Jackson annotations, bypassing the intended access control boundary.
• Nested objects and collection elements within the targeted resource can be mutated, meaning an attacker can alter relational data that spans multiple levels of the object graph.
• Modified records are persisted to the backing data store, so the tampering survives restarts and affects all downstream consumers of that data.
• There is no confidentiality or availability impact: data is not disclosed and services are not disrupted, but the integrity of persisted application state is directly compromised.