Spring AI CVE-2026-41712

No special conditions - remote unauthenticated exploitation against default configurations of Spring AI applications utilizing the chat memory component. Exploitation is most effective in multi-user or multi-tenant environments where concurrent users interact with the same Spring AI instance. However, the vulnerability is limited to applications that have not explicitly configured chat memory isolation and rely on the framework's default settings. Single-user or properly isolated implementations where developers have overridden default chat memory configuration are not vulnerable. The network attack vector (AV:N) means the application must be network-accessible, but no special network position, user interaction (UI:N), or authentication (PR:N) is required.

This vulnerability presents significant real-world risk for production Spring AI applications handling multiple users. The CVSS 7.5 (High) score accurately reflects the severity: network-accessible (AV:N), low complexity exploitation (AC:L), no authentication required (PR:N), and high confidentiality impact (C:H). An attacker needs only network access to a vulnerable Spring AI application to potentially view other users' chat histories, prompts, and AI responses. The attack complexity is low because exploitation likely requires simple timing manipulation or session enumeration rather than sophisticated techniques. The scope is unchanged (S:U), meaning the vulnerability is contained within Spring AI's security context, but the confidentiality breach can expose sensitive business data, personal information, or proprietary prompts shared with AI systems. No EPSS, KEV, or POC data is available in the provided intelligence, suggesting either recent disclosure or limited public visibility. The Java ecosystem tag indicates this affects enterprise environments where Spring AI may process confidential corporate communications or customer data. Priority should be HIGH for any organization running Spring AI in production with multiple users, as the unauthenticated network vector and high confidentiality impact create immediate data breach risk. The absence of integrity or availability impact (I:N/A:N) means this is strictly an information disclosure vulnerability, not allowing system compromise or service disruption.

An attacker accesses a Spring AI-powered chatbot application used by multiple customers of an enterprise. Without authentication or by using a valid but low-privilege account, the attacker crafts requests to the chat endpoint while monitoring timing or session identifiers. Due to the default shared memory configuration, the attacker's chat session intermittently receives responses containing fragments of other users' conversations, exposing confidential customer queries, business data, or personal information previously submitted to the AI system. The attacker systematically collects this leaked data by repeatedly initiating chat sessions during periods of concurrent user activity.