CVE-2026-41837: spring spring data rest Improper Access Control
Vulnerability summary
CVE-2026-41837 is a medium (CVSS 5.3) Improper Access Control vulnerability in spring spring data rest. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.6% of scored vulnerabilities.
Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 30-06-2026Last modifiedVulnerability information updated.
Description
Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14; 4.5.0 through 4.5.11; 5.0.0 through 5.0.5.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
+0.12 pp
From 0.19% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Org.springframework.data1 product
- spring-data-rest-core≥ 5.0.0, < 5.0.6 | ≥ 4.5.0, < 4.5.12 | ≥ 4.4.0, ≤ 4.4.14 | ≥ 4.3.0, ≤ 4.3.16 | ≤ 3.7.19
Spring1 product
- spring data rest≥ 3.7.0, < 3.7.20 | ≥ 4.3.0, < 4.3.17 | ≥ 4.4.0, < 4.4.15 | ≥ 4.5.0, < 4.5.11.1 | ≥ 5.0.0, < 5.0.5.1
Vmware1 product
- spring_data_rest≥ 3.7.0, < 3.7.20 | ≥ 4.3.0, < 4.3.17 | ≥ 4.4.0, < 4.4.15 | ≥ 4.5.0, < 4.5.11.1 | ≥ 5.0.0, < 5.0.5.1
3 vendors · 3 products
