What is the CVSS score of CVE-2026-40967?

CVE-2026-40967 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Spring AI are affected by CVE-2026-40967?

Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4 contain a filter expression injection vulnerability that allows unauthenticated remote attackers to manipulate vector store queries and potentially…. A patch is available.

How to fix or mitigate CVE-2026-40967?

Within 24 hours: Inventory all applications using Spring AI and identify those running versions 1.0.0-1.0.5 or 1.1.0-1.1.4. Within 7 days: Upgrade to Spring AI 1.0.6 or 1.1.5 (or later); prioritize production systems exposing filter parameters to end users. Within 30 days: Conduct input validation audit of any FilterExpressionConverter implementations and validate that all vector store integrations enforce parameterized queries.

Spring AI CVE-2026-40967

EUVD-2026-25994 HIGH

Code Injection (CWE-94)

2026-04-28 vmware

GHSA-qc4j-qjqx-vr58

Java Code Injection RCE

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 29, 2026 - 19:04 nvd

Patch available

Apr 28, 2026 - 08:01 EUVD

Analysis Updated

Apr 28, 2026 - 07:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 28, 2026 - 07:22 vuln.today

cvss_changed

CVSS changed

Apr 28, 2026 - 07:22 NVD

8.2 (HIGH) 8.6 (HIGH)

Analysis Generated

Apr 28, 2026 - 06:45 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 06:30 euvd

EUVD-2026-25994

Analysis Generated

Apr 28, 2026 - 06:30 vuln.today

CVE Published

Apr 28, 2026 - 06:03 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

162 maven packages depend on org.springframework.ai:spring-ai-vector-store (35 direct, 127 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionCVE.org

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.

Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

AnalysisAI

Filter expression injection in Spring AI 1.0.0-1.0.5 and 1.1.0-1.1.4 allows remote unauthenticated attackers to manipulate vector store queries through unescaped keys and values in FilterExpressionConverter implementations. The vulnerability enables query language injection across multiple vector database backends, potentially exposing sensitive data (CVSS:C:H) and modifying query results (CVSS:I:L). VMware has released patches in versions 1.0.6 and 1.1.5. No active exploitation confirmed (not in CISA KEV), but the network-accessible attack vector (AV:N/AC:L/PR:N) and code injection classification (CWE-94) indicate significant risk for applications processing untrusted filter expressions.

Technical ContextAI

Spring AI is a framework for building AI-powered applications in Java, providing abstractions for vector databases and similarity search operations. The vulnerability affects FilterExpressionConverter implementations, which translate Spring AI's filter expression objects into vendor-specific query languages for vector stores (e.g., Pinecone, Weaviate, Milvus, ChromaDB). CWE-94 (Improper Control of Generation of Code/Code Injection) indicates that user-controlled input is incorporated into dynamically constructed queries without proper sanitization. When filter expression keys and values are not escaped during translation to the target vector store's query syntax, attackers can inject additional query commands, operators, or logic similar to SQL injection but targeting vector database query languages. The affected CPE cpe:2.3:a:spring:spring_ai confirms this is a core Spring AI framework vulnerability, not limited to a single vector store backend.

RemediationAI

Upgrade to Spring AI 1.0.6 if running 1.0.x versions, or upgrade to Spring AI 1.1.5 if running 1.1.x versions, as confirmed by VMware in the security advisory at https://spring.io/security/cve-2026-40967. Review application code to identify all locations where filter expressions are constructed from user input or external sources, then apply strict input validation on filter expression keys and values before passing to FilterExpressionConverter implementations. If immediate patching is not feasible, implement compensating controls: restrict filter expression functionality to authenticated trusted users only (reduces PR:N to PR:L/H), enforce allowlists for permitted filter keys and operators (blocks injection attempts), or disable dynamic filter expression features entirely until patching completes (eliminates attack surface but may impact application functionality). Each workaround trades functionality for security: allowlists require maintenance as legitimate use cases evolve, disabling features may break user workflows, and restricting to authenticated users still leaves insider threat exposure. Vector store access credentials should follow least-privilege principles to limit blast radius if query injection succeeds.