Spring AI CVE-2026-59319

Exploitation requires all of the following: (1) the application uses Spring AI 2.0.0 with RedisChatMemoryRepository backed by Redis and the RediSearch module; (2) the application exposes a code path that calls findByMetadata() with a value derived from user-controlled input targeting a tag-typed metadata field; (3) the attacker holds a valid low-privilege authenticated session in the application (PR:L per the provided CVSS vector). Exploitation is bounded by the authentication requirement - unauthenticated internet-based attacks are not possible. Applications that do not route user input to findByMetadata(), or that apply their own RediSearch-aware sanitization before the call, are not exploitable even when running the affected Spring AI version.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects moderate real-world risk that is accurately characterized by the vector. Network reachability with low attack complexity means exploitation is technically straightforward, but the PR:L requirement - a valid authenticated session - rules out unauthenticated internet-scale abuse. The confidentiality impact is formally rated Low, yet the practical consequence of reading all chat messages across every conversation in the index may represent meaningful exposure depending on application context: conversations could contain PII, session context, business logic, or sensitive user data. No EPSS score was included in the provided intelligence, preventing probabilistic exploitation comparison. The CVE does not appear in the CISA KEV catalog, and no POC code was referenced, indicating no confirmed widespread active exploitation at time of analysis. Actual risk is conditional on whether a given deployment passes user-controlled values to findByMetadata() on tag-typed fields - applications that do not exercise this code path with untrusted input are not exposed regardless of version.

An authenticated user of an application backed by Spring AI's Redis chat memory submits a crafted metadata filter value - for example, x} | * - to a search or retrieval endpoint that internally calls findByMetadata() on a tag-typed field. Because the value is not escaped, the injected wildcard breaks out of the intended tag clause, and the resulting RediSearch query returns chat messages from all users' conversations stored in the index. No public exploit code is known to exist at time of analysis.