Executive brief
Spring Data MongoDB, a library used to connect Java applications to MongoDB databases, contains a security flaw in how it handles database queries. An attacker could potentially execute unauthorized commands or access sensitive data by exploiting how the system processes specific search parameters. This could lead to a full compromise of the application's data and underlying server operations.
Technical details
Spring Data MongoDB is vulnerable to SpEL (Spring Expression Language) expression injection (CWE-917). The vulnerability exists in the parameter binding process of user-defined repository query methods. Specifically, it is triggered when a method is annotated with @Query and utilizes a capture-all placeholder, allowing unvalidated input to be evaluated as a SpEL expression. A remote attacker can exploit this over the network without authentication, though the attack complexity is rated as high. Successful exploitation allows for arbitrary code execution or unauthorized data access. Patches are available in versions 5.0.6 and 4.5.12.
Affected products
- VMware Spring Data MongoDB 5.0.0 to 5.0.5, 4.5.0 to 4.5.11, 4.4.0 to 4.4.14, 4.3.0 to 4.3.16, 4.2.0 to 4.2.15, 4.1.0 to 4.1.14, 4.0.0 to 4.0.15, 3.4.0 to 3.4.19
Timeline
- 2026-06-10: disclosed: Initial disclosure date
- 2026-06-10: advisory
- 2026-08-12: other: Advisory updated