Spring Data MongoDB CVE-2026-41696

Exploitation requires that the application uses a Spring Data MongoDB repository method annotated with @Query that includes a regex parameter binding (e.g., $regex: ?0), AND that attacker-controlled input reaches that bound parameter without prior sanitization or escaping. Applications that do not use @Query with regex bindings are entirely unaffected. The CVSS AC:H rating reflects this conditional dependency. From the network perspective, no authentication is required (PR:N) and no user interaction is needed (UI:N), but the application must expose the vulnerable code path to attacker-reachable requests. Exploitation is limited by: (1) the application must use this specific annotation and binding pattern; (2) user input must flow unsanitized into the regex parameter; (3) the attacker must be able to reach the relevant endpoint. These conditions meaningfully narrow the exposed population beyond what the raw CVSS network vector implies.

The CVSS 5.9 Medium score is composed of a network attack vector (AV:N), no required privileges (PR:N), no user interaction (UI:N), but high attack complexity (AC:H), unchanged scope (S:U), and impact confined to confidentiality (C:H) with no integrity or availability consequence. The AC:H rating is the primary risk moderator and reflects that exploitation is conditional on the target application using @Query with regex binding and exposing that path to attacker-controlled input - a specific pattern, though not rare in Spring Data MongoDB codebases. No EPSS score was provided in the source data, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified. Real-world risk is moderate-to-significant for applications matching the vulnerable pattern: the C:H impact means a successful exploit could expose the full result set of a query, potentially leaking sensitive MongoDB documents. Applications that do not use @Query with regex parameters are unaffected, which limits the population at risk compared to a framework-wide vulnerability.

An application exposes a product search API that passes a user-supplied search term directly to a Spring Data MongoDB repository method annotated with @Query containing a regex binding such as { 'name': { $regex: ?0, $options: 'i' } }. An attacker submits a crafted string containing unescaped regex syntax that breaks out of the intended literal quoting, causing MongoDB to evaluate a modified regular expression that matches a broader set of documents - including records the attacker is not intended to access. No public exploit code has been identified, but the injection pattern is well-understood from prior NoSQL and regex injection research and does not require elevated tooling.