Executive brief
Spring Data MongoDB is a software library used by developers to connect Java applications to MongoDB databases. A vulnerability in how the library handles search queries allows an attacker to bypass intended security filters by providing specially crafted search terms. This could lead to unauthorized access to sensitive data that should have been protected by the application's query logic.
Technical details
Spring Data MongoDB is vulnerable to a query logic injection (CWE-943) within repository methods annotated with @Query. The vulnerability exists when these methods utilize regular expression (regex) parameter binding. Due to insufficient validation and improper neutralization of special elements in the bound parameters, an attacker can provide a crafted input string that escapes the intended regex quoting. This allows the attacker to manipulate the resulting MongoDB query, potentially leading to unauthorized data retrieval. The attack requires the application to expose a query parameter that is bound to a regex in a @Query method. Patches are available in versions 5.0.6 and 4.5.12.
Affected products
- VMware Spring Data MongoDB 5.0.0 to 5.0.5, 4.5.0 to 4.5.11, 4.4.0 to 4.4.14, 4.3.0 to 4.3.16, 4.2.0 to 4.2.15, 4.1.0 to 4.1.14, 4.0.0 to 4.0.15, 3.4.0 to 3.4.19
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-08-12: patched
References
- https://spring.io/security/cve-2026-41696
- https://github.com/spring-projects/spring-data-mongodb/issues/5205
- https://github.com/spring-projects/spring-data-mongodb/commit/24d5afc0c7df223150e06fce3f64c226bcc88ca2
- https://github.com/spring-projects/spring-data-mongodb/commit/7d2ea784d262bf4bf4ea8402505f491c8ab66fcc