Spring Data Relational CVE-2026-41697

The application must use Spring Data Relational, JDBC, or R2DBC in an affected version and must have at least one repository query that uses the Query By Example (QBE) feature with StringMatcher.STARTING, StringMatcher.ENDING, or StringMatcher.CONTAINING applied to a user-controlled input field. The vulnerable code path is only reachable when the QBE endpoint is exposed over the network and accepts externally-controlled string parameters that flow into the wildcard-generating StringMatcher without prior sanitization. Exploitation is limited by AC:H: the attacker must be able to distinguish boolean outcomes (results vs. no results) from the endpoint's response to construct a successful inference attack, which requires knowledge of the data model and patience across many requests. Deployments where QBE is used only with server-controlled or validated inputs, or where StringMatcher is restricted to EXACT mode, are not affected. Authentication requirements are not confirmed from CVSS alone (PR:N indicates no privileges needed at the framework level), but application-layer authentication gating a QBE endpoint would significantly limit exploitability in practice.

The CVSS base score of 4.8 (Medium) reflects a nuanced risk posture: AV:N confirms the attack is remotely reachable, PR:N confirms no authentication is required, and UI:N removes any need for victim interaction - all high-severity signals. However, AC:H (High Complexity) acknowledges that exploitation requires non-trivial effort: the attacker must identify a QBE-backed endpoint, understand the query structure well enough to craft effective boolean probes, and execute a multi-step inference process. The impact is bounded - C:L indicates limited confidentiality exposure (partial data leakage via inference, not bulk dump), I:N confirms no write capability, and A:L suggests minor availability degradation, possibly from query load generated by the inference attack. EPSS data is not available in the provided input and cannot be cited. No KEV listing and no POC code are identified, making this a low-urgency but genuine information disclosure risk for affected applications. The realistic priority is elevated for applications where QBE is exposed to unauthenticated or low-trust users (e.g., public search APIs), and lower for applications where QBE is only used in authenticated, internal workflows.

An attacker discovers a public-facing REST search endpoint (e.g., /api/users?name=alice) backed by a Spring Data JDBC repository using QBE with StringMatcher.CONTAINING. By submitting names like 'a%p%secret%' and observing HTTP 200 (results) vs. empty responses, the attacker iteratively infers email addresses, usernames, or other column values through boolean-based blind inference, one character or token at a time. No public exploit code has been identified, and the AC:H rating reflects that this requires deliberate, multi-request inference logic rather than a single-shot exploit.