What is the CVSS score of CVE-2026-47835?

CVE-2026-47835 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.5%.

Which versions of Spring AI are affected by CVE-2026-47835?

Spring AI Vector Stores (versions 1.0.0-1.0.8 and 1.1.0-1.1.7) are vulnerable to remote NoSQL injection attacks that allow unauthenticated actors to execute arbitrary queries against Elasticsearch,…. A patch is available.

How to fix or mitigate CVE-2026-47835?

24 hours: Audit all applications and infrastructure to identify Spring AI deployments using versions 1.0.0-1.0.8 or 1.1.0-1.1.7. 7 days: Implement input sanitization and character validation for all user-supplied text fed to Spring AI vector stores, apply network segmentation to limit vector database access, and document risk acceptance. 30 days: Monitor Spring Framework announcements for patched versions (Spring AI 1.0.9+ or 1.1.8+); upgrade immediately upon release or transition to alternative vector-store libraries if no patch timeline is disclosed.

Spring AI CVE-2026-47835

EUVD-2026-36796 HIGH

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

2026-06-15 vmware

GHSA-cmwh-w62w-r2mf

Nosql Injection Java Elastic Information Disclosure Spring Ai

8.6

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

vuln.today AI

8.6 HIGH

Remote network-exposed RAG endpoints accept untrusted input with no auth or interaction (AV:N/AC:L/PR:N/UI:N); injection yields full index reads (C:H) but only limited tampering and disruption (I:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Jun 15, 2026 - 21:01 EUVD

Analysis Generated

Jun 15, 2026 - 19:55 vuln.today

CVE Published

Jun 15, 2026 - 18:54 cve.org

HIGH 8.6

DescriptionCVE.org

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store.

Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).

Articles & Coverage 2

News 3 New Java Vulnerabilities - 3 High Severity Jun 16, 2026 News 3 New Java Vulnerabilities - 3 High Severity, No Public Exploits Jun 15, 2026

AnalysisAI

NoSQL/query injection in Spring AI Vector Stores (1.0.0-1.0.8 and 1.1.0-1.1.7) allows remote unauthenticated attackers to inject special characters into vector-store inputs and force execution of arbitrary queries against Elasticsearch, OpenSearch, and GemFire VectorDB backends. The flaw resides in the spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store components, enabling information disclosure and limited integrity/availability impact against any application embedding Spring AI's vector-store abstraction. No public exploit identified at time of analysis, but the CVSS 8.6 (scope unchanged here, network vector, no privileges) makes this a high-priority patch for any Spring AI deployment ingesting untrusted text.

Technical ContextAI

Spring AI is VMware/Broadcom's framework for building generative-AI applications on the JVM, and its Vector Stores module provides a uniform abstraction over vector databases used in RAG (retrieval-augmented generation) pipelines. The affected modules - spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store - translate Java-level filter expressions and metadata predicates into native queries (Elasticsearch/OpenSearch Query DSL JSON and GemFire OQL). CWE-943 (Improper Neutralization of Special Elements in Data Query Logic) indicates that special characters in user-controlled inputs are not properly escaped or parameterized when constructing those queries, allowing an attacker to break out of the intended query structure. Because CPE coverage is spring:spring_ai:* (all versions of the framework prior to the fixes), any downstream application that exposes Spring AI search functionality to untrusted callers inherits the vulnerability.

RemediationAI

Vendor-released patches are available: upgrade Spring AI to 1.0.9 (for the 1.0.x line) or 1.1.8 (for the 1.1.x line) as documented at https://spring.io/security/cve-2026-47835, ensuring any transitive dependency on spring-ai-elasticsearch-store, spring-ai-opensearch-store, or spring-ai-gemfire-store is pinned to the fixed versions. Where immediate upgrade is not possible, compensating controls include rejecting or sanitizing user input containing query-DSL metacharacters before it reaches VectorStore.similaritySearch() or filter expression APIs, restricting the Elasticsearch/OpenSearch/GemFire credentials used by the application to a least-privilege role scoped to the specific vector index (so injected queries cannot read unrelated indices), and placing an application-level allowlist on metadata filter fields; note that aggressive input filtering can break legitimate prompts containing punctuation, and credential scoping requires re-provisioning datastore roles which may impact other workloads sharing the same cluster.