# CVE-2026-41730: VMware Spring Data REST information disclosure in exception serialization

Source: https://junglewise.ai/threats/cve-2026-41730-vmware-spring-data-rest-information-disclosure-in-exception  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-41730 · Severity: medium · CVSS 5.3 · Published 2026-06-10

Spring Data REST, a framework used to build web services that interact with databases, contains a vulnerability that may leak sensitive internal information. When an error occurs, the system includes detailed technical data about the database and application structure in its response to the user. This information could be used by an attacker to better understand the internal workings of the system and plan further attacks.

Technologies: [org.springframework.data:spring-data-rest-core (Maven)](https://junglewise.ai/threats/technologies/org-springframework-data-spring-data-rest-core), [VMware Spring Data REST](https://junglewise.ai/threats/technologies/spring-data-rest). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41730 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41730 being exploited in the wild.

**How severe is CVE-2026-41730?** Medium severity, with a CVSS score of 5.3, published 10 June 2026.

**Which products and versions are affected?** org.springframework.data:spring-data-rest-core (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.6; VMware Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.

**Is there a fix for CVE-2026-41730?** Yes. org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41730 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41730?** Check whether you run org.springframework.data:spring-data-rest-core (Maven) or VMware Spring Data REST at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later

  ```sh
  # set org.springframework.data:spring-data-rest-core to 5.0.6 in your pom.xml or build.gradle
  ```


## Technical details

Spring Data REST is vulnerable to information exposure (CWE-209) because it serializes the full exception cause chain into HTTP error response bodies. This behavior occurs when an application encounters an error during data persistence operations, causing the framework to return detailed stack traces or internal database metadata to the requester. An unauthenticated remote attacker can trigger these errors through standard HTTP requests to the REST API. This exposure reveals persistence-layer internals, such as database schema details or internal class names, which can facilitate reconnaissance for further exploitation. The issue is addressed in versions 4.5.12 and 5.0.6.

## Affected products

- Spring Spring Data REST 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5

## Identifiers

- CVE-2026-41730
- GHSA-p5mm-xwgq-whfr

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-06-09: patched: Versions 4.5.12 and 5.0.6 released

## References

- [https://spring.io/security/cve-2026-41730](https://spring.io/security/cve-2026-41730)
- [https://github.com/spring-projects/spring-data-rest/releases/tag/4.5.12](https://github.com/spring-projects/spring-data-rest/releases/tag/4.5.12)
- [https://github.com/spring-projects/spring-data-rest/releases/tag/5.0.6](https://github.com/spring-projects/spring-data-rest/releases/tag/5.0.6)

## Related threats

- [Spring Data REST identifier and version property mutation via JSON Patch](https://junglewise.ai/threats/cve-2026-47849-spring-data-rest-identifier-and-version-property-mutation-via)
- [Spring Data REST version property not preserved on immutable PUT](https://junglewise.ai/threats/cve-2026-47850-spring-data-rest-version-property-not-preserved-on-immutable-put)
- [VMware Spring Data REST improper access control in Querydsl integration](https://junglewise.ai/threats/cve-2026-41837-vmware-spring-data-rest-improper-access-control-in-querydsl)
- [VMware Spring Data REST SpEL injection in JSON Patch processing](https://junglewise.ai/threats/cve-2026-41729-vmware-spring-data-rest-spel-injection-in-json-patch-processing)
- [VMware Spring Data REST improper access control in JSON Patch](https://junglewise.ai/threats/cve-2026-41728-vmware-spring-data-rest-improper-access-control-in-json-patch)