What is the CVSS score of CVE-2026-40978?

CVE-2026-40978 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Spring AI are affected by CVE-2026-40978?

Spring AI's CosmosDBVectorStore component contains a SQL injection vulnerability affecting versions 1.0.0-1.0.5 and 1.1.0-1.1.4 that allows authenticated users to execute arbitrary database queries,…. A patch is available.

How to fix or mitigate CVE-2026-40978?

Within 24 hours: Identify all deployed instances of Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4 in your environment and document their exposure level (production vs. non-production). Within 7 days: Upgrade all affected instances to Spring AI version 1.0.6 or 1.1.5 per VMware's advisory, beginning with production systems. Within 30 days: Conduct a security audit of vector store API access logs from the past 90 days to detect potential exploitation attempts, and review access controls to enforce least-privilege authentication to the vector store API.

Spring AI CVE-2026-40978

EUVD-2026-26011 HIGH

SQL Injection (CWE-89)

2026-04-28 security@vmware.com

GHSA-63c8-m9m2-cvr3

Java SQLi

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 29, 2026 - 18:16 nvd

Patch available

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Patch available

Apr 28, 2026 - 10:01 EUVD

Analysis Generated

Apr 28, 2026 - 09:30 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 09:22 euvd

EUVD-2026-26011

Analysis Generated

Apr 28, 2026 - 09:22 vuln.today

CVE Published

Apr 28, 2026 - 09:16 nvd

HIGH 8.8

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 maven packages depend on org.springframework.ai:spring-ai-azure-cosmos-db-store (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionCVE.org

SQL injection vulnerability in Spring AI's CosmosDBVectorStore allows attackers to execute arbitrary SQL queries via crafted document IDs.

Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

AnalysisAI

SQL injection in Spring AI's CosmosDBVectorStore component (versions 1.0.0-1.0.5 and 1.1.0-1.1.4) enables authenticated remote attackers to execute arbitrary SQL queries through malicious document IDs, potentially achieving full database compromise including data exfiltration, modification, and denial of service. VMware has released patches in versions 1.0.6 and 1.1.5. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires low-privilege authenticated access to the vector store API.

Technical ContextAI

Spring AI is a Java framework for building AI applications with vector database integrations. The CosmosDBVectorStore component provides integration with Azure Cosmos DB for vector similarity search operations. This CWE-89 SQL injection vulnerability occurs when user-controlled document IDs are improperly sanitized before being incorporated into SQL queries sent to the underlying Cosmos DB. The vulnerability affects the document ID parameter handling, which should be treated as untrusted input but is instead passed directly into SQL query construction. Standard SQL injection attack techniques apply: attackers can break out of the intended query context using metacharacters, append malicious SQL statements, or use UNION-based injection to extract arbitrary data from the database.

RemediationAI

Upgrade to Spring AI version 1.0.6 (for 1.0.x series users) or version 1.1.5 (for 1.1.x series users), both of which contain fixes for the SQL injection vulnerability per VMware's security advisory at https://spring.io/security/cve-2026-40978. If immediate patching is not feasible, implement strict input validation on document IDs before they reach the CosmosDBVectorStore API: whitelist alphanumeric characters only, reject any IDs containing SQL metacharacters (quotes, semicolons, dashes, parentheses), and enforce maximum length limits. Additionally, ensure the Cosmos DB connection uses a database account with minimum necessary privileges (read/write to specific collections only, no admin rights) to limit blast radius if SQL injection occurs. Network segmentation to restrict Cosmos DB access to application servers only provides defense-in-depth but does not prevent authenticated application users from exploiting the vulnerability. These workarounds reduce but do not eliminate risk - patching remains the only complete remediation.