What is the CVSS score of CVE-2026-41717?

CVE-2026-41717 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring Data MongoDB are affected by CVE-2026-41717?

Spring Data MongoDB contains a critical SpEL expression injection vulnerability (CVE-2026-41717) that enables unauthenticated remote code execution on affected systems.. A patch is available.

How to fix or mitigate CVE-2026-41717?

Within 24 hours: Inventory all systems running Spring Data MongoDB and identify @Query-annotated repository methods that accept user-influenced parameters with capture-all placeholders. Within 7 days: Implement strict input validation on all query parameters, remediate or refactor vulnerable @Query patterns to use explicit parameter bindings, and deploy Web Application Firewall rules to detect SpEL injection signatures (${, #{, method invocations). Within 30 days: Maintain continuous monitoring of Spring Data MongoDB security advisories; apply vendor patch immediately upon release and conduct comprehensive testing before production deployment.

Spring Data MongoDB CVE-2026-41717

EUVD-2026-35900 HIGH

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-06-10 security@vmware.com

GHSA-5whc-4q84-fj73

Code Injection Java Spring Data Mongodb

8.1

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (vmware) · only source for this CVE.

CVSS VectorVendor: vmware

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:33 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

37 maven packages depend on org.springframework.data:spring-data-mongodb (13 direct, 24 indirect)

Ecosystem-wide dependent count for version 5.0.0.

DescriptionCVE.org

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.

Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

AnalysisAI

Remote code execution risk in Spring Data MongoDB arises from a SpEL expression injection flaw (CWE-917) triggered during parameter binding for repository methods annotated with @Query that use a capture-all placeholder. With CVSS 8.1 (AV:N/AC:H/PR:N/UI:N) and no public exploit identified at time of analysis, unauthenticated attackers who can influence query parameters reaching such a method could execute arbitrary SpEL expressions on the server.

Technical ContextAI

Spring Data MongoDB is the Spring Data module that maps Java domain objects onto MongoDB and exposes the @Query annotation so developers can declare JSON-based MongoDB query strings on repository interfaces. Spring's parameter binding for these annotated query methods evaluates SpEL expressions inside the query template; when the template uses a capture-all placeholder (e.g. ?#{...} style or a placeholder that absorbs the entire bound parameter), user-controlled input flows directly into the SpEL evaluation context. This is a textbook CWE-917 (Improper Neutralization of Special Elements Used in an Expression Language Statement) defect: tainted data is concatenated into an interpreted expression instead of being treated as a parameter value, and SpEL - being a full expression language with type/method access - can be coerced into invoking arbitrary methods on reachable Java objects, leading to code execution. No CPE strings were supplied in the input, but the vendor advisory enumerates a wide release matrix spanning the 3.4.x, 4.0.x-4.5.x, and 5.0.x branches.

RemediationAI

Upgrade Spring Data MongoDB to a fixed release on your branch - the advisory at https://spring.io/security/cve-2026-41717 should be consulted for the exact patched build, but logically the fixes are above the ranges listed (i.e. 5.0.6+, 4.5.12+, 4.4.15+, 4.3.17+, 4.2.16+, 4.1.15+, 4.0.16+, and 3.4.20+ once published); cite the vendor advisory for the authoritative fix version because exact patched releases are not independently confirmed in the input data. As an interim compensating control, audit all @Query-annotated repository methods and remove capture-all SpEL placeholders, replacing them with positional parameter binding (?0, ?1) which is not evaluated as SpEL; this requires changing query strings but does not break the repository abstraction. Where a SpEL placeholder is genuinely required, ensure the bound value is a strictly validated allow-listed string rather than free-form user input. At the perimeter, WAF rules that block SpEL syntax tokens (e.g. T(, #{, new ) in request parameters provide partial defense but are easily bypassed and should not be relied on as a primary control.