CVE-2026-41717 is an expression language injection vulnerability (CWE-917) in Spring Data MongoDB. The issue arises when parameter binding occurs in repository query methods annotated with @Query that utilize a capture-all placeholder. This improper neutralization of special elements in SpEL expressions can lead to injection attacks. The vulnerability affects Spring Data MongoDB versions 3.4.0 through 3.4.19, 4.0.0 through 4.0.15, 4.1.0 through 4.1.14, 4.2.0 through 4.2.15, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5. No official patch or remediation level is currently documented in the provided data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary expressions within the Spring Expression Language context, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using user-defined repository query methods with @Query annotations that utilize capture-all placeholders in affected versions. Monitor vendor communications for updates on patches or official mitigations.