Skip to main content

Spring AI CVE-2026-41712

| EUVD-2026-29448 HIGH
Incorrect Default Permissions (CWE-276)
2026-05-12 vmware GHSA-q62f-h9x2-gcqc
Privilege Escalation Java Information Disclosure
7.5
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Patch available
May 12, 2026 - 12:02 EUVD
Analysis Generated
May 12, 2026 - 11:30 vuln.today
CVE Published
May 12, 2026 - 10:17 nvd
HIGH 7.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 37 maven packages depend on org.springframework.ai:spring-ai-client-chat (6 direct, 31 indirect)
  • 131 maven packages depend on org.springframework.ai:spring-ai-model (31 direct, 100 indirect)

Ecosystem-wide dependent count for version 1.1.0-M1 and other introduced versions.

DescriptionNVD

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

AnalysisAI

Remote unauthenticated attackers can access confidential data from other users' chat sessions in Spring AI applications due to insecure default configuration in the chat memory component. The vulnerability allows network-based exploitation with no authentication required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and impacts confidentiality only (C:H/I:N/A:N), enabling cross-user data leakage in multi-tenant AI chat implementations. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Inventory all Spring AI deployments and identify applications using the chat memory component; assess whether explicit chat memory isolation has been configured. Within 7 days: Implement mandatory access controls and tenant isolation at the application layer; segregate chat session storage by user/tenant; conduct data access audit to detect prior unauthorized access. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-41712 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy