What is the CVSS score of EUVD-2026-12795?

EUVD-2026-12795 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Java are affected by EUVD-2026-12795?

A critical access control bypass vulnerability in Spring AI allows authenticated users to circumvent document access restrictions and retrieve unauthorized data through crafted filter expressions.. A patch is available.

How to fix or mitigate EUVD-2026-12795?

Within 24 hours: Identify all applications using Spring AI's AbstractFilterExpressionConverter and assess which handle sensitive multi-tenant or access-controlled data; implement network segmentation to limit lateral movement if compromise occurs. Within 7 days: Deploy input validation and escaping middleware to sanitize filter expressions before processing; enable enhanced logging and monitoring for suspicious filter patterns. Within 30 days: Evaluate and implement alternative vector store implementations or apply official patch immediately upon release; conduct forensic review of access logs for evidence of exploitation.

Java EUVD-2026-12795

| CVE-2026-22729 HIGH

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-03-18 vmware

GHSA-rp9g-qx29-88cp

Java Authentication Bypass

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 18, 2026 - 08:00 euvd

EUVD-2026-12795

Analysis Generated

Mar 18, 2026 - 08:00 vuln.today

CVE Published

Mar 18, 2026 - 07:39 nvd

HIGH 8.6

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

45 maven packages depend on org.springframework.ai:spring-ai-vector-store (25 direct, 20 indirect)

Ecosystem-wide dependent count for version 1.1.0-M1.

DescriptionCVE.org

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.

This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.

The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.

AnalysisAI

Spring AI's AbstractFilterExpressionConverter fails to properly escape user-controlled input in JSONPath queries, allowing authenticated attackers to inject arbitrary expressions and bypass access controls in vector store implementations. This impacts applications relying on the converter for multi-tenant isolation, role-based access, or metadata-based document filtering, enabling attackers to access unauthorized documents. No patch is currently available.

Technical ContextAI

Spring AI is VMware's framework for building AI-powered applications in Java, specifically working with vector databases and large language models. The vulnerability affects the AbstractFilterExpressionConverter component used in vector store implementations, where applications leverage JSONPath expressions to filter documents based on metadata attributes. The root cause is improper neutralization of special elements used in commands (similar to injection flaws), where user-supplied values containing special characters like double quotes, logical OR (||), and logical AND (&&) operators are concatenated directly into JSONPath queries without sanitization or parameterization. This allows attackers to break out of the intended query structure and inject arbitrary JSONPath logic that can alter query semantics, particularly bypassing filters designed to enforce tenant boundaries or access controls based on document metadata in vector search operations.

RemediationAI

Upgrade VMware Spring AI to version 1.0.4 or later for the 1.0.x branch, or to version 1.1.3 or later for the 1.1.x branch as documented in the vendor advisory at https://spring.io/security/cve-2026-22729. Until patching is completed, implement compensating controls by validating and sanitizing all user-supplied input used in filter expressions before passing to FilterExpressionBuilder, specifically escaping or rejecting special JSONPath characters including double quotes, pipes (||), ampersands (&&), brackets, and other JSONPath operators. Organizations should also review their vector store implementations to ensure proper input validation is enforced at the application layer, consider implementing allowlists for permitted filter field names and values, and audit existing access control logic to verify it cannot be bypassed through query manipulation. For high-risk deployments, consider temporarily disabling user-controlled filter expressions in favor of server-side predetermined filters until patches can be applied.