# CVE-2026-41729: VMware Spring Data REST SpEL injection in JSON Patch processing

Source: https://junglewise.ai/threats/cve-2026-41729-vmware-spring-data-rest-spel-injection-in-json-patch-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-41729 · Severity: high · CVSS 8.1 · Published 2026-06-10

Spring Data REST is a framework used to build web services that interact with databases. A security flaw exists where the system incorrectly processes certain update requests (JSON Patch) involving map-based data. An attacker with basic user access could exploit this to execute unauthorized commands or access sensitive information, potentially leading to a significant data breach.

Technologies: [org.springframework.data:spring-data-rest-core (Maven)](https://junglewise.ai/threats/technologies/org-springframework-data-spring-data-rest-core), [VMware Spring Data REST](https://junglewise.ai/threats/technologies/spring-data-rest). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41729 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41729 being exploited in the wild.

**How severe is CVE-2026-41729?** High severity, with a CVSS score of 8.1, published 10 June 2026.

**Which products and versions are affected?** org.springframework.data:spring-data-rest-core (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.6; VMware Spring Data REST 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5, 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

**Is there a fix for CVE-2026-41729?** Yes. org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41729 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41729?** Check whether you run org.springframework.data:spring-data-rest-core (Maven) or VMware Spring Data REST at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later

  ```sh
  # set org.springframework.data:spring-data-rest-core to 5.0.6 in your pom.xml or build.gradle
  ```


## Technical details

Spring Data REST is vulnerable to Spring Expression Language (SpEL) injection (CWE-917) when processing 'application/json-patch+json' requests. The vulnerability occurs when a persistent entity exposes a Map-typed property; the JSON Pointer path segment used as the map key is embedded directly into a SpEL expression without proper sanitization or validation. A remote attacker with low privileges can send a specially crafted JSON Patch request to execute arbitrary SpEL expressions. This can lead to unauthorized data access or modification. Patches are available in versions 4.5.12 and 5.0.6.

## Affected products

- Spring Spring Data REST 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5

## Identifiers

- CVE-2026-41729
- GHSA-j388-8rm5-p97f

## Timeline

- 2026-06-09: patched: Versions 4.5.12 and 5.0.6 released
- 2026-06-10: disclosed: Initial advisory publication
- 2026-08-12: advisory: Advisory updated by GitHub

## References

- [https://spring.io/security/cve-2026-41729](https://spring.io/security/cve-2026-41729)
- [https://github.com/spring-projects/spring-data-rest/releases/tag/4.5.12](https://github.com/spring-projects/spring-data-rest/releases/tag/4.5.12)
- [https://github.com/spring-projects/spring-data-rest/releases/tag/5.0.6](https://github.com/spring-projects/spring-data-rest/releases/tag/5.0.6)

## Related threats

- [Spring Data REST identifier and version property mutation via JSON Patch](https://junglewise.ai/threats/cve-2026-47849-spring-data-rest-identifier-and-version-property-mutation-via)
- [Spring Data REST version property not preserved on immutable PUT](https://junglewise.ai/threats/cve-2026-47850-spring-data-rest-version-property-not-preserved-on-immutable-put)
- [VMware Spring Data REST improper access control in Querydsl integration](https://junglewise.ai/threats/cve-2026-41837-vmware-spring-data-rest-improper-access-control-in-querydsl)
- [VMware Spring Data REST information disclosure in exception serialization](https://junglewise.ai/threats/cve-2026-41730-vmware-spring-data-rest-information-disclosure-in-exception)
- [VMware Spring Data REST improper access control in JSON Patch](https://junglewise.ai/threats/cve-2026-41728-vmware-spring-data-rest-improper-access-control-in-json-patch)