Spring AI CVE-2026-47852

Exploitation requires the attacker to hold an active, low-privileged local account on the same host as the Spring AI application - remote or anonymous exploitation is not consistent with the vulnerability description, despite the conflicting CVSS AV:N vector. The core enabling condition is that Spring AI selects a deterministic, predictable path for its ONNX model cache, and that the parent directory of that path is writable by users other than the application's service account (for example, /tmp or a shared data directory). The application must be using ONNX model caching functionality - deployments that do not use ONNX models or that disable caching are not exposed. Exploitation is limited to: multi-user hosts where untrusted local accounts coexist with the Spring AI service account; affected Spring AI versions (1.0.0-1.0.9, 1.1.0-1.1.8, 2.0.0); and environments where the cache directory parent is accessible to non-application users. Containerized deployments, single-tenant VMs, and systems with a correctly permissioned cache directory are not meaningfully at risk.

The most significant risk signal here is the conflict between the provided CVSS vector (AV:N/AC:L/PR:N/UI:N, implying unauthenticated network exploitation) and the description, which explicitly states a local attacker on a multi-user host - these are irreconcilable, and the discrepancy must be resolved against the vendor advisory before teams make patch prioritization decisions. Treating the description as authoritative, the realistic attack vector is local (AV:L) with low-privilege requirements (PR:L), which would yield a substantially lower base score than 7.5. No EPSS data was provided, no CISA KEV listing is present, and no public exploit code has been identified, indicating no confirmed active exploitation. The attack is conditional on a shared multi-user host where unprivileged users can write to parent directories of the ONNX cache path - containerized, single-tenant, or properly permissioned deployments are not meaningfully exposed. The 'Information Disclosure' tag in the intelligence metadata also conflicts with the CVSS impact of I:H/C:N/A:N, suggesting the tag is erroneous. Taken together, this is a real but narrowly scoped integrity risk that deserves patching in shared-host Java AI deployments, but does not warrant emergency response in isolated or containerized environments.

A local attacker with a non-privileged account on a shared Linux application server identifies the deterministic path Spring AI will use when caching its ONNX model - for example by inspecting source code or running the application under a test account. Before the application initializes or refreshes its model cache, the attacker pre-creates the target path and writes a crafted ONNX model file designed to produce adversarial inference results or trigger a deserialization flaw in the underlying ONNX runtime. When the Spring AI application next loads its model from cache, it reads the attacker-planted file, silently corrupting the integrity of AI-driven functionality. No public proof-of-concept has been identified at time of analysis.