This vulnerability (CVE-2026-40991) involves improper restriction of XML External Entity references (CWE-611) in Spring REST Docs. Specifically, when using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who either compromises the API or deceives the user into documenting a malicious API can perform an XXE injection attack. This attack occurs when the documentation-generating tests are executed, potentially allowing the attacker to cause high confidentiality impact without affecting integrity and with low availability impact. The affected versions are Spring REST Docs 4.0.0, 3.0.0 through 3.0.5, and 2.0.0.RELEASE through 2.0.8.RELEASE. No official patch or remediation level has been provided at this time.

The vulnerability allows an attacker to perform an XML External Entity injection attack during the execution of documentation-generating tests that access a remote API over HTTP. This can lead to a high confidentiality impact, potentially exposing sensitive data. The integrity of the system is not impacted, and availability impact is low. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when documenting remote APIs accessed over HTTP, especially if the API source is untrusted or potentially compromised. Avoid documenting untrusted or suspicious APIs using spring-restdocs-webtestclient or spring-restdocs-restassured to mitigate risk.