CVE-2026-41717

Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

8.1 HighFix available

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter binding when a user-defined repository query method is annotated with @Query and utilizes a capture-all placeholder.

Affected versions: Spring Data MongoDB 5.0.0 through 5.0.5; 4.5.0 through 4.5.11; 4.4.0 through 4.4.14; 4.3.0 through 4.3.16; 4.2.0 through 4.2.15; 4.1.0 through 4.1.14; 4.0.0 through 4.0.15; 3.4.0 through 3.4.19.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.33%Up 0.3 points since Jun 10, 2026

What each source reports

CVE List Score used 8.1

Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Record: CVE-2026-41717
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-917
Updated: 2026-11-02

EUVDEUVD-2026-35900 8.1

Record: EUVD-2026-35900
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-5whc-4q84-fj73 8.1

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Record: GHSA-5whc-4q84-fj73
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-917
Updated: 2026-11-02

NVD 8.1

Record: CVE-2026-41717
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-917
Updated: 2026-11-02

OSV 8.1

Spring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter Binding

Record: CVE-2026-41717
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-917
Updated: 2026-11-02

OSVGHSA-5whc-4q84-fj73 8.1

Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection

Record: GHSA-5whc-4q84-fj73
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-917
Updated: 2026-11-02

Show 17 moreShow less

OSVCLSA-2026-1788422135 No score

TuxCare security update for org.springframework.data (2 CVEs)

TuxCare rebuilt 3 org.springframework.data packages to address 2 CVEs. Fixed in 4.3.13-tuxcare.5.

Record: CLSA-2026-1788422135
Updated: 2026-11-02

OSVCLSA-2026-1788446203 No score

TuxCare security update for org.springframework.data (2 CVEs)

TuxCare rebuilt 3 org.springframework.data packages to address 2 CVEs. Fixed in 3.4.18-tuxcare.8.

Record: CLSA-2026-1788446203
Updated: 2026-11-02

OSVCLSA-2026-1789286187 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 4.3.13-tuxcare.5.

Record: CLSA-2026-1789286187
Updated: 2026-11-02

OSVCLSA-2026-1789667915 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 3.4.16-tuxcare.1.

Record: CLSA-2026-1789667915
Updated: 2026-11-02

OSVCLSA-2026-1790002143 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (2 CVEs)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 2 CVEs. Fixed in 4.4.13-tuxcare.3.

Record: CLSA-2026-1790002143
Updated: 2026-11-02

OSVCLSA-2026-1790002371 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 4.1.8-tuxcare.1.

Record: CLSA-2026-1790002371
Updated: 2026-11-02

OSVCLSA-2026-1790062789 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 4.2.12-tuxcare.4.

Record: CLSA-2026-1790062789
Updated: 2026-11-02

OSVCLSA-2026-1790097396 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 3.4.18-tuxcare.9.

Record: CLSA-2026-1790097396
Updated: 2026-11-02

OSVCLSA-2026-1790246710 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 4.3.12-tuxcare.2.

Record: CLSA-2026-1790246710
Updated: 2026-11-02

OSVCLSA-2026-1790610946 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 3.1.8-tuxcare.1.

Record: CLSA-2026-1790610946
Updated: 2026-11-02

OSVCLSA-2026-1790674824 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 3.2.11-tuxcare.1.

Record: CLSA-2026-1790674824
Updated: 2026-11-02

OSVCLSA-2026-1790678445 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 3.2.12-tuxcare.1.

Record: CLSA-2026-1790678445
Updated: 2026-11-02

OSVCLSA-2026-1790688883 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 4.0.12-tuxcare.1.

Record: CLSA-2026-1790688883
Updated: 2026-11-02

OSVCLSA-2026-1792491290 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 3.1.9-tuxcare.3.

Record: CLSA-2026-1792491290
Updated: 2026-11-02

OSVCLSA-2026-1792585916 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 3.3.10-tuxcare.3.

Record: CLSA-2026-1792585916
Updated: 2026-11-02

OSVCLSA-2026-1793202131 No score

TuxCare security update for org.springframework.data:spring-data-mongodb (1 CVE)

TuxCare rebuilt org.springframework.data:spring-data-mongodb to address 1 CVE. Fixed in 3.0.5.RELEASE-tuxcare.1.

Record: CLSA-2026-1793202131
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2026-41717 No score

CVE-2026-41717 in org.springframework.data:spring-data-mongodb - Patched by Root

Root has patched CVE-2026-41717 in the org.springframework.data:spring-data-mongodb package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2026-41717
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.springframework.data:spring-data-mongodb` Maven	5.0.0 to 5.0.5	5.0.6
`org.springframework.data:spring-data-mongodb` Maven	4.5.0 to 4.5.11	4.5.12
`org.springframework.data:spring-data-mongodb` Maven	4.4.0 to 4.4.14	None known
`org.springframework.data:spring-data-mongodb` Maven	4.0.0 to 4.3.16	None known
`org.springframework.data:spring-data-mongodb` Maven	through 3.4.19	None known
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	4.3.13 up to 4.3.13-tuxcare.5, plus listed versions 4.3.13-tuxcare.14.3.13-tuxcare.24.3.13-tuxcare.34.3.13-tuxcare.4	4.3.13-tuxcare.5
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	3.4.16 up to 3.4.16-tuxcare.1	3.4.16-tuxcare.1
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	4.4.13 up to 4.4.13-tuxcare.3, plus listed versions 4.4.13-tuxcare.14.4.13-tuxcare.2	4.4.13-tuxcare.3
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	4.1.8 up to 4.1.8-tuxcare.1	4.1.8-tuxcare.1
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	4.2.12 up to 4.2.12-tuxcare.4, plus listed versions 4.2.12-tuxcare.14.2.12-tuxcare.24.2.12-tuxcare.3	4.2.12-tuxcare.4

Show 16 moreShow less

Affected packages
Package	Affected	Fixed
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	3.4.18 up to 3.4.18-tuxcare.9, plus listed versions 3.4.18-tuxcare.13.4.18-tuxcare.23.4.18-tuxcare.33.4.18-tuxcare.43.4.18-tuxcare.5 Show 4 moreShow less 3.4.18-tuxcare.63.4.18-tuxcare.73.4.18-tuxcare.83.4.18.tuxcare	3.4.18-tuxcare.9
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	4.3.12 up to 4.3.12-tuxcare.2, plus listed versions 4.3.12-tuxcare.1	4.3.12-tuxcare.2
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	3.1.8 up to 3.1.8-tuxcare.1	3.1.8-tuxcare.1
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	3.2.11 up to 3.2.11-tuxcare.1	3.2.11-tuxcare.1
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	3.2.12 up to 3.2.12-tuxcare.1	3.2.12-tuxcare.1
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	4.0.12 up to 4.0.12-tuxcare.1	4.0.12-tuxcare.1
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	3.1.9 up to 3.1.9-tuxcare.3, plus listed versions 3.1.9-tuxcare.13.1.9-tuxcare.2	3.1.9-tuxcare.3
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	3.3.10 up to 3.3.10-tuxcare.3, plus listed versions 3.3.10-tuxcare.13.3.10-tuxcare.2	3.3.10-tuxcare.3
`org.springframework.data:spring-data-mongodb` TuxCare:Maven	3.0.5.RELEASE up to 3.0.5.RELEASE-tuxcare.1	3.0.5.RELEASE-tuxcare.1
`org.springframework.data:spring-data-mongodb` Maven	5.0.0 up to 5.0.6, plus listed versions 5.0.15.0.25.0.35.0.45.0.5	5.0.6
`org.springframework.data:spring-data-mongodb` Maven	4.5.0 up to 4.5.12, plus listed versions 4.5.14.5.104.5.114.5.24.5.3 Show 6 moreShow less 4.5.44.5.54.5.64.5.74.5.84.5.9	4.5.12
`org.springframework.data:spring-data-mongodb` Maven	4.4.0 to 4.4.14, plus listed versions 4.4.14.4.104.4.114.4.124.4.13 Show 8 moreShow less 4.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9	None known
`org.springframework.data:spring-data-mongodb` Maven	4.0.0 to 4.3.16, plus listed versions 4.0.14.0.104.0.114.0.124.0.2 Show 45 moreShow less 4.0.34.0.44.0.54.0.64.0.74.0.84.0.94.1.04.1.14.1.104.1.114.1.124.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.94.2.04.2.14.2.104.2.114.2.124.2.24.2.34.2.44.2.54.2.64.2.74.2.84.2.94.3.04.3.14.3.104.3.114.3.124.3.134.3.24.3.34.3.44.3.54.3.64.3.7	None known
`org.springframework.data:spring-data-mongodb` Maven	through 3.4.19, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.0.3.RELEASE1.0.4.RELEASE Show 45 moreShow less 1.1.0.RELEASE1.1.1.RELEASE1.1.2.RELEASE1.10.0.RELEASE1.10.1.RELEASE1.10.10.RELEASE1.10.11.RELEASE1.10.12.RELEASE1.10.13.RELEASE1.10.14.RELEASE1.10.15.RELEASE1.10.16.RELEASE1.10.17.RELEASE1.10.18.RELEASE1.10.2.RELEASE1.10.20.RELEASE1.10.21.RELEASE1.10.22.RELEASE1.10.23.RELEASE1.10.3.RELEASE1.10.4.RELEASE1.10.5.RELEASE1.10.6.RELEASE1.10.7.RELEASE1.10.8.RELEASE1.10.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.2.RELEASE1.5.4.RELEASE	None known
`org.springframework.data:spring-data-mongodb` Root:Maven	before 4.5.10-aikido.1	4.5.10-aikido.15.0.4-aikido.14.3.5-aikido.1
`io.root.org.springframework.data:spring-data-mongodb` Root:Maven	before 4.5.10-root.io.1	4.5.10-root.io.15.0.4-root.io.14.3.5-root.io.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-41717 is a high vulnerability (CVSS 8.1) in Spring Data Mongodb, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in org.springframework.data:spring-data-mongodb 5.0.6.

References

This page doesn't list everything

Left out here: 150 versions. The JSON record has them.