What is the CVSS score of CVE-2026-41712?

CVE-2026-41712 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring AI are affected by CVE-2026-41712?

Spring AI chat memory components contain an insecure default configuration that allows unauthenticated remote attackers to access other users' confidential chat session data across multi-tenant…. A patch is available.

How to fix or mitigate CVE-2026-41712?

Within 24 hours: Inventory all Spring AI deployments and identify applications using the chat memory component; assess whether explicit chat memory isolation has been configured. Within 7 days: Implement mandatory access controls and tenant isolation at the application layer; segregate chat session storage by user/tenant; conduct data access audit to detect prior unauthorized access. Within 30 days: Deploy compensating controls listed below; coordinate with VMware/Spring team for patch availability; plan upgrade timeline once patch is released.

Spring AI CVE-2026-41712

EUVD-2026-29448 HIGH

Incorrect Default Permissions (CWE-276)

2026-05-12 vmware

GHSA-q62f-h9x2-gcqc

Information Disclosure Java Privilege Escalation

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

May 12, 2026 - 12:02 EUVD

Analysis Generated

May 12, 2026 - 11:30 vuln.today

CVE Published

May 12, 2026 - 10:17 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

37 maven packages depend on org.springframework.ai:spring-ai-client-chat (6 direct, 31 indirect)
131 maven packages depend on org.springframework.ai:spring-ai-model (31 direct, 100 indirect)

Ecosystem-wide dependent count for version 1.1.0-M1 and other introduced versions.

DescriptionCVE.org

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

AnalysisAI

Remote unauthenticated attackers can access confidential data from other users' chat sessions in Spring AI applications due to insecure default configuration in the chat memory component. The vulnerability allows network-based exploitation with no authentication required (CVSS:3.1 AV:N/AC:L/PR:N/UI:N) and impacts confidentiality only (C:H/I:N/A:N), enabling cross-user data leakage in multi-tenant AI chat implementations. Reported by VMware, affecting Java-based Spring AI deployments where developers have not explicitly configured chat memory isolation.

Technical ContextAI

Spring AI is VMware's framework for building AI-powered applications in Java ecosystems. The vulnerability resides in the chat memory component, which maintains conversation state and context for AI interactions. Chat memory components typically store user prompts, AI responses, and session context to enable coherent multi-turn conversations. The problematic default configuration fails to implement proper isolation boundaries between user sessions, allowing one user's memory context to leak into another's. This affects applications built on the Spring AI framework (CPE: cpe:2.3:a:vmware:spring_ai) where developers rely on default chat memory settings rather than explicitly configuring session isolation mechanisms. The issue represents a classic framework security misconfiguration where secure-by-default principles were not applied to a multi-user feature.

RemediationAI

Upgrade to the patched version of Spring AI specified in VMware's security advisory at https://spring.io/security/cve-2026-41712, which addresses the insecure default in the chat memory component. If immediate patching is not feasible, implement explicit chat memory isolation by configuring session-scoped memory instances per user with proper access controls. Developers should override the default chat memory configuration to use user-specific memory contexts, ensuring each user session maintains isolated conversation history. This can typically be achieved by binding chat memory instances to authenticated user sessions and implementing session validation before memory access. Review application code to ensure chat memory components are initialized with user-scoped isolation rather than shared global state. For applications where chat memory functionality is not essential, consider disabling the feature entirely until patching is complete. Note that workaround implementations may impact performance in high-concurrency scenarios due to increased memory overhead from per-user isolation.