What is the CVSS score of CVE-2026-40979?

CVE-2026-40979 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40979?

Yes, a patch is available for CVE-2026-40979. Update the affected software to the latest version immediately.

Spring AI CVE-2026-40979

EUVD-2026-26012 MEDIUM

Insecure Temporary File (CWE-377)

2026-04-28 security@vmware.com

Information Disclosure Java

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 29, 2026 - 18:16 nvd

Patch available

Apr 28, 2026 - 10:01 EUVD

Analysis Generated

Apr 28, 2026 - 09:30 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 09:22 euvd

EUVD-2026-26012

Analysis Generated

Apr 28, 2026 - 09:22 vuln.today

CVE Published

Apr 28, 2026 - 09:16 nvd

MEDIUM 6.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

4 maven packages depend on org.springframework.ai:spring-ai-transformers (4 direct, 0 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionCVE.org

In Spring AI, having access to a shared environment can expose the ONNX model used by the application.

Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

AnalysisAI

Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4 expose ONNX machine learning models to unauthorized disclosure when the application runs in shared hosting environments, allowing local users with limited system access to read sensitive model files and potentially reverse-engineer proprietary ML logic. The vulnerability stems from insecure temporary file handling (CWE-377) that fails to restrict file permissions on extracted model artifacts. Authentication requirements are minimal-only local system access is needed-making this a significant risk in multi-tenant cloud platforms and shared servers.

Technical ContextAI

Spring AI is a Java framework for building applications with artificial intelligence and machine learning capabilities. The vulnerability originates in CWE-377 (Insecure Temporary File), which occurs when the framework extracts ONNX (Open Neural Network Exchange) model files to temporary directories without properly restricting access permissions. ONNX is an open standard for representing trained machine learning models, widely used for neural networks and deep learning inference. When Spring AI unpacks or caches these models-likely during initialization or model loading-the resulting files are created with default world-readable permissions in shared temporary directories (e.g., /tmp on Linux). A local attacker with limited privileges (PR:L per CVSS) can enumerate and read these world-accessible model files, potentially reconstructing the neural network architecture, weights, and training data artifacts, which constitute intellectual property.

RemediationAI

Upgrade Spring AI to version 1.0.6 or later (for 1.0.x branch) or 1.1.5 or later (for 1.1.x branch) immediately. These patched versions enforce restrictive file permissions (e.g., chmod 600 or equivalent ACLs) when extracting or caching ONNX model files to temporary directories. Consult https://spring.io/security/cve-2026-40979 for release notes and upgrade guidance. For environments unable to upgrade immediately, apply compensating controls: (1) Use operating system-level security to restrict /tmp and TMPDIR access to the application user only (e.g., mount /tmp with noexec,nosuid,mode=1777 on Linux and enforce umask 0077 for the application JVM process), though this may impact other applications and has side effects on system functionality; (2) Deploy Spring AI in containerized, single-tenant environments (Docker, Kubernetes with network policies) where shared temp access is not possible; (3) Use ephemeral or encrypted temporary storage that is wiped between process lifecycles; (4) Disable or relocate ONNX model caching to a restricted directory with explicit chmod 700 permissions, if the Spring AI framework allows configuration of temp directories. Test any workaround in non-production before deployment.