CVE-2026-41696 affects Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding. The vulnerability arises from insufficient validation of the bound regex parameter, which can be manipulated by an attacker to break out of the intended regular expression quoting. This improper neutralization of special elements in data query logic may lead to unintended query behavior. The CVSS v3.1 base score is 5.9 (medium severity), with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker can craft a malicious string parameter to bypass the intended regex quoting in Spring Data MongoDB queries, potentially causing unauthorized data exposure due to improper query filtering. The confidentiality impact is rated high, but there is no impact on integrity or availability. Exploitation requires network access and is of high complexity, with no privileges or user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using regex parameter binding in @Query methods or implement strict input validation and sanitization on regex parameters to prevent injection of special characters that could break regex quoting.