CVE-2026-41729: Spring Data REST SpEL Injection via Map Key in JSON Patch

Synopsis

SpEL (Spring Expression Language) injection in Spring Data REST allows an authenticated attacker to embed arbitrary expressions inside JSON Patch requests targeting Map-typed entity properties. The vulnerable path processing accepts a JSON Pointer segment as a map key and passes it directly to the SpEL evaluator without sanitization, reachable over the network with any low-privilege account. Successful exploitation gives the attacker full read and write access to application data in scope of the evaluated expression context. Patched-image rebuilds at versions 3.7.20, 4.3.17, 4.4.15, 4.5.12, and 5.0.6 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Spring Data REST HTTP endpoint over the network; the service must be accessible remotely for the PATCH request to be delivered.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker does not need admin credentials, only a valid authenticated session that can issue PATCH requests to an exposed repository endpoint.

• Victim interactionNot required

  No user interaction is needed; the attacker sends a crafted JSON Patch request directly to the server without any action from another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental preconditions.

Blast Radius

• Reads any data accessible through the SpEL evaluation context, including entity fields, application properties, and Spring bean state exposed at expression scope.
• Writes or modifies persisted entity data by executing SpEL expressions that invoke setter methods or mutate Map-typed properties on the targeted domain object.
• Allows traversal to other Spring beans within the application context, potentially invoking methods on services or repositories beyond the originally targeted entity.