CVE-2026-41003
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in Spring Security allows an attacker who can influence values in RelyingPartyRegistration to execute arbitrary code in HTML forms generated by Spring Security filters. The issue affects multiple versions of Spring Security from 5.7.0 through 7.0.5.
Risk Assessment
The risk involves potential remote code execution (RCE) within the application context, which could lead to server compromise, data theft, or further attacks on the infrastructure.
Recommendation
Immediately upgrade Spring Security to versions 5.7.24, 5.8.26, 6.3.17, 6.4.17, 6.5.11, or 7.0.6 (depending on the used line) and review RelyingPartyRegistration configuration for unauthorized changes.
Original NVD description (English source)
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.