5.9
Medium
CVE-2026-40966 In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat…
Description
In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.
Affected products and versions
Other CVEs of Spring AI
The 5 CVEs of Spring AI →
CVE-2026-41713
A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an…
8.2
High
CVE-2026-41712
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result…
7.5
High
CVE-2026-22729
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass…
8.6
High
CVE-2026-22730
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass…
8.8
High