CVE-2026-41696: VMware Spring Data MongoDB query injection in @Query regex binding

CVE-2026-41696 · Severity: medium · CVSS 5.9 · Published 2026-06-10

Spring Data MongoDB is a software library used by developers to connect Java applications to MongoDB databases. A vulnerability in how the library handles search queries allows an attacker to bypass intended security filters by providing specially crafted search terms. This could lead to unauthorized access to sensitive data that should have been protected by the application's query logic.

Technologies: org.springframework.data:spring-data-mongodb (Maven). Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41696 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41696 being exploited in the wild.
How severe is CVE-2026-41696?
Medium severity, with a CVSS score of 5.9, published 10 June 2026.
Which products and versions are affected?
org.springframework.data:spring-data-mongodb (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.6; VMware Spring Data MongoDB 5.0.0 to 5.0.5, 4.5.0 to 4.5.11, 4.4.0 to 4.4.14, 4.3.0 to 4.3.16, 4.2.0 to 4.2.15, 4.1.0 to 4.1.14, 4.0.0 to 4.0.15, 3.4.0 to 3.4.19.
Is there a fix for CVE-2026-41696?
Yes. org.springframework.data:spring-data-mongodb (Maven): upgrade to 5.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41696 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41696?
Check whether you run org.springframework.data:spring-data-mongodb (Maven) or VMware Spring Data MongoDB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.data:spring-data-mongodb (Maven): upgrade to 5.0.6 or later
    # set org.springframework.data:spring-data-mongodb to 5.0.6 in your pom.xml or build.gradle

Technical details

Spring Data MongoDB is vulnerable to a query logic injection (CWE-943) within repository methods annotated with @Query. The vulnerability exists when these methods utilize regular expression (regex) parameter binding. Due to insufficient validation and improper neutralization of special elements in the bound parameters, an attacker can provide a crafted input string that escapes the intended regex quoting. This allows the attacker to manipulate the resulting MongoDB query, potentially leading to unauthorized data retrieval. The attack requires the application to expose a query parameter that is bound to a regex in a @Query method. Patches are available in versions 5.0.6 and 4.5.12.

Affected products

  • VMware Spring Data MongoDB 5.0.0 to 5.0.5, 4.5.0 to 4.5.11, 4.4.0 to 4.4.14, 4.3.0 to 4.3.16, 4.2.0 to 4.2.15, 4.1.0 to 4.1.14, 4.0.0 to 4.0.15, 3.4.0 to 3.4.19

Identifiers

  • CVE-2026-41696
  • GHSA-hc43-m36c-8v33

Timeline

  • 2026-06-10: disclosed
  • 2026-06-10: advisory
  • 2026-08-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.