Is CVE-2026-41837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41837 being exploited in the wild.

How severe is CVE-2026-41837?

Medium severity, with a CVSS score of 5.3, published 10 June 2026.

Which products and versions are affected?

org.springframework.data:spring-data-rest-core (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.6; VMware Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5; VMware Spring Data REST core 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5.

Is there a fix for CVE-2026-41837?

Yes. org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41837 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41837?

Check whether you run org.springframework.data:spring-data-rest-core (Maven), VMware Spring Data REST or VMware Spring Data REST core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41837: VMware Spring Data REST improper access control in Querydsl integration

CVE-2026-41837 · Severity: medium · CVSS 5.3 · Published 2026-06-10

Spring Data REST is a framework used to automatically export database resources as web services. A vulnerability in its integration with the Querydsl filtering tool allows unauthorized users to access internal data fields that were intended to be hidden. This could lead to the exposure of sensitive information that should not be visible through the public web interface.

Technologies: org.springframework.data:spring-data-rest-core (Maven), VMware Spring Data REST. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41837 being exploited in the wild.
How severe is CVE-2026-41837?: Medium severity, with a CVSS score of 5.3, published 10 June 2026.
Which products and versions are affected?: org.springframework.data:spring-data-rest-core (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.6; VMware Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5; VMware Spring Data REST core 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5.
Is there a fix for CVE-2026-41837?: Yes. org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41837 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41837?: Check whether you run org.springframework.data:spring-data-rest-core (Maven), VMware Spring Data REST or VMware Spring Data REST core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework.data:spring-data-rest-core (Maven): upgrade to 5.0.6 or later

# set org.springframework.data:spring-data-rest-core to 5.0.6 in your pom.xml or build.gradle

Technical details

An improper access control vulnerability exists in Spring Data REST's Querydsl integration. The component accepts arbitrary persistent property paths as request-parameter filter keys without validating them against Jackson customizations (such as @JsonIgnore). This allows a remote, unauthenticated attacker to bypass field-level security constraints and query internal entity properties via specially crafted request parameters. The vulnerability affects multiple versions of Spring Data REST and is resolved in versions 4.5.12, 5.0.6, and later.

Affected products

VMware Spring Data REST core 3.7.0 - 3.7.19, 4.3.0 - 4.3.16, 4.4.0 - 4.4.14, 4.5.0 - 4.5.11, 5.0.0 - 5.0.5

Identifiers

CVE-2026-41837
GHSA-mwpv-rg79-863c

Timeline

2026-06-10: disclosed
2026-06-10: advisory

References

https://spring.io/security/cve-2026-41837

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.