CVE-2026-41730: VMware Spring Data REST information disclosure in exception serialization

CVE-2026-41730 · Severity: medium · CVSS 5.3 · Published 2026-06-10

Spring Data REST, a framework used to build web services that interact with databases, contains a vulnerability that may leak sensitive internal information. When an error occurs, the system includes detailed technical data about the database and application structure in its response to the user. This information could be used by an attacker to better understand the internal workings of the system and plan further attacks.

Technologies: org.springframework.data:spring-data-rest-core (Maven), VMware Spring Data REST. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41730 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41730 being exploited in the wild.
How severe is CVE-2026-41730?
Medium severity, with a CVSS score of 5.3, published 10 June 2026.
Which products and versions are affected?
org.springframework.data:spring-data-rest-core (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.6; VMware Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
Is there a fix for CVE-2026-41730?
Yes. org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41730 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41730?
Check whether you run org.springframework.data:spring-data-rest-core (Maven) or VMware Spring Data REST at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later
    # set org.springframework.data:spring-data-rest-core to 5.0.6 in your pom.xml or build.gradle

Technical details

Spring Data REST is vulnerable to information exposure (CWE-209) because it serializes the full exception cause chain into HTTP error response bodies. This behavior occurs when an application encounters an error during data persistence operations, causing the framework to return detailed stack traces or internal database metadata to the requester. An unauthenticated remote attacker can trigger these errors through standard HTTP requests to the REST API. This exposure reveals persistence-layer internals, such as database schema details or internal class names, which can facilitate reconnaissance for further exploitation. The issue is addressed in versions 4.5.12 and 5.0.6.

Affected products

  • Spring Spring Data REST 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5

Identifiers

  • CVE-2026-41730
  • GHSA-p5mm-xwgq-whfr

Timeline

  • 2026-06-10: disclosed
  • 2026-06-10: advisory
  • 2026-06-09: patched: Versions 4.5.12 and 5.0.6 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.