Spring Data REST CVE-2026-41729

Exploitation requires four specific conditions drawn from the CVE description and CVSS vector: (1) the target application must be Spring Data REST 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, or 5.0.0-5.0.5; (2) at least one exposed persistent entity must declare a Map-typed property that Spring Data REST renders as a patchable resource; (3) the attacker must be able to submit a request with Content-Type application/json-patch+json to the resource endpoint; and (4) per CVSS PR:L, the attacker must hold a low-privilege authenticated account permitted to PATCH the affected resource. Limiting factors: applications without Map-typed entity properties, deployments that disable JSON Patch support, or those that require high-privilege roles for PATCH on these endpoints are not exploitable; UI:N means no victim interaction is needed once those conditions are met.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with data exfiltration or tampering via expression evaluation rather than denial of service. The PR:L requirement means the attacker needs at least an authenticated low-privilege account on the application, which materially limits opportunistic mass exploitation but does not protect deployments where self-registration or low-trust user accounts can reach REST endpoints. EPSS and CISA KEV data were not provided in the input, and no public exploit identified at time of analysis; however, the CWE-917 class is historically very automatable once a working payload is published, and the vendor advisory at spring.io/security/cve-2026-41729 should be monitored for patch confirmation. Treat as a high-priority patching item for any internet-facing Spring Data REST deployment that exposes Map-typed properties through JSON Patch.

An attacker with a low-privilege application account discovers a Spring Data REST endpoint backed by an entity containing a Map field (e.g., /people/42 where Person has a Map<String,String> attributes). They send a PATCH request with Content-Type application/json-patch+json whose 'path' member encodes a malicious SpEL expression in place of a map key - for example, '/attributes/T(java.lang.Runtime).getRuntime().exec(...)' - causing the server to evaluate the expression during patch processing and leak data or modify state. No public exploit identified at time of analysis, but the technique mirrors prior public SpEL injection PoCs.