CVE-2026-41717 is an expression language injection vulnerability (CWE-917) in Spring Data MongoDB. It arises during parameter binding in user-defined repository query methods annotated with @Query that utilize a capture-all placeholder. This improper neutralization of special elements in Spring Expression Language statements allows an attacker to inject and execute arbitrary expressions. The affected versions include 3.4.0 through 3.4.19, 4.0.0 through 4.0.15, 4.1.0 through 4.1.14, 4.2.0 through 4.2.15, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could lead to full compromise of confidentiality, integrity, and availability of affected systems due to arbitrary expression execution within Spring Data MongoDB queries. This may allow attackers to execute unauthorized commands or access sensitive data. The CVSS 3.1 base score of 8.1 reflects a high severity vulnerability with network attack vector, high complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using user-defined repository query methods with @Query annotations that utilize capture-all placeholders in affected versions. Monitor official Spring project communications for updates and apply patches promptly once available.