Spring Data MongoDB EUVD-2026-35900

Exploitation requires a target application to declare a Spring Data MongoDB repository method annotated with @Query whose query string uses a capture-all SpEL placeholder, and to bind attacker-controllable input (typically an HTTP request parameter or body field) to that method's argument. Limiting factors per the CVSS vector are the AC:H rating reflecting the need for a vulnerable code pattern, the requirement that the application run an affected Spring Data MongoDB version (3.4.0-3.4.19, 4.0.0-4.0.15, 4.1.0-4.1.14, 4.2.0-4.2.15, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, or 5.0.0-5.0.5), and reachability of the affected endpoint from the attacker's network position. No authentication is required per PR:N, no user interaction is required per UI:N, and scope is unchanged per S:U.

The CVSS 8.1 vector indicates network reach with no privileges or user interaction, but with high attack complexity - meaning exploitation depends on application-specific conditions (the target must actually expose a vulnerable @Query method with a capture-all placeholder and route attacker-controllable input into it). EPSS, KEV, SSVC and POC data were not supplied in the input, so probabilistic and real-world exploitation signals are unknown. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV based on the data provided. The realistic risk is therefore highly dependent on application code: organizations whose repositories never use SpEL placeholders are largely unaffected, while those with custom @Query methods using capture-all placeholders face a serious unauthenticated RCE pathway. The AC:H rating should not be used to deprioritize patching for Java/Spring-heavy estates because the complexity reflects code-pattern prevalence, not exploit difficulty once a vulnerable method is reachable.

An attacker submits a crafted value via an HTTP request parameter that the application passes to a Spring Data MongoDB repository method annotated with @Query using a capture-all placeholder; the value is interpolated into the query template, parsed as a SpEL expression, and executed server-side, allowing the attacker to invoke arbitrary Java methods and ultimately achieve remote code execution as the application user. No public exploit is identified at time of analysis, but the pattern is closely analogous to prior Spring SpEL injection issues for which weaponized payloads emerged rapidly.