Spring Ai CVE-2026-22729

Authenticated user access to applications using Spring AI vector stores that extend AbstractFilterExpressionConverter for metadata filtering. Attacker crafts malicious filter expressions through FilterExpressionBuilder to inject JSONPath logic bypassing access controls. No user interaction required. Affects multi-tenant, role-based access control, or document-filtering deployments.

The CVSS 3.1 score of 8.6 indicates high severity with critical factors: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), scope change (S:C), and high confidentiality impact (C:H). However, the description mentions authenticated users are needed, which conflicts with the PR:N rating and suggests the actual attack prerequisites may be higher than the vector indicates. The vulnerability specifically targets applications implementing multi-tenant isolation or role-based access controls using Spring AI vector stores, making it high-risk only for these specific deployment patterns rather than all Spring AI installations. Without EPSS data or KEV listing available in the provided intelligence, and with the vulnerability recently disclosed (2026), there is no evidence of active exploitation yet. The real-world risk is elevated for organizations using Spring AI for tenant isolation in SaaS applications or implementing metadata-based document filtering, as successful exploitation directly defeats security boundaries. For applications not using AbstractFilterExpressionConverter for access control purposes, the risk is significantly lower.

An attacker authenticates to a multi-tenant SaaS application built with Spring AI that uses vector stores for document retrieval with metadata-based tenant isolation. The attacker crafts a document search request containing a malicious filter expression such as metadata[?(@.tenant_id"victim_tenant" || @.tenant_id"attacker_tenant")] which injects JSONPath logic to bypass the intended tenant_id filter. The application concatenates this unsanitized input into the JSONPath query, allowing the attacker to retrieve confidential documents belonging to other tenants that should be isolated, effectively breaking the multi-tenant security boundary and accessing unauthorized data across tenant boundaries.