SB20260828185 - Multiple vulnerabilities in Spring Data REST

Description

This security bulletin contains information about 4 vulnerabilities.

1) Improper Neutralization of Special Elements used in an Expression Language Statement (CVE-ID: CVE-2026-41729)

CWE-ID: CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary SpEL expressions.

The vulnerability exists due to improper neutralization of special elements used in an expression language statement in JSON Patch map key processing when handling PATCH requests with application/json-patch+json content. A remote user can send a specially crafted PATCH request with a malicious map-key path segment to execute arbitrary SpEL expressions.

Both read and write patch paths are affected, and exploitation requires that the exposed aggregate or a reachable embedded type declares a map-typed persistent property.

2) Improper access control (CVE-ID: CVE-2026-41728)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to modify read-only nested properties.

The vulnerability exists due to improper access control in Spring Data REST JSON Patch processing when resolving multi-segment JSON Pointer paths. A remote attacker can send a specially crafted JSON Patch request to modify read-only nested properties.

Affected applications include domain models with an embeddable object, collection, or map property whose container is marked read-only at the Jackson level while the inner element type has no per-field restriction.

3) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-41730)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose persistence-layer internals.

The vulnerability exists due to insertion of sensitive information into sent data in Spring Data REST error response bodies when handling requests that trigger exceptions. A remote attacker can send a request that triggers an error to disclose persistence-layer internals.

Only applications that expose a Spring Data REST repository backed by a relational store and do not restrict unauthenticated access to the affected endpoints are vulnerable.

4) Improper access control (CVE-ID: CVE-2026-41837)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in Spring Data REST Querydsl integration when processing request-parameter filter keys. A remote attacker can supply arbitrary persistent property paths as filter parameters to disclose sensitive information.

Jackson customizations are not considered before the property paths are handed to Querydsl, which can expose persistent fields that were intended to be hidden.

Remediation

Install update from vendor's website.

References

• https://spring.io/security/cve-2026-41729
• https://spring.io/security/cve-2026-41728
• https://spring.io/security/cve-2026-41730
• https://spring.io/security/cve-2026-41837