Spring AI EUVD-2026-26011

Exploitation requires the attacker to have authenticated access (PR:L) to an application using Spring AI's CosmosDBVectorStore component with vulnerable versions 1.0.0-1.0.5 or 1.1.0-1.1.4. The attacker must have the ability to control or influence document IDs passed to CosmosDBVectorStore operations, which depends on the application's API design - some applications may allow users to specify custom document identifiers while others generate them internally. Network accessibility (AV:N) means remote exploitation is possible if the application exposes vector store functionality through web APIs, REST endpoints, or other network services. No user interaction is required (UI:N) beyond the attacker's own authenticated session. Exploitation is limited to applications specifically using the CosmosDBVectorStore implementation; other Spring AI vector store backends (Pinecone, Weaviate, etc.) are not affected by this vulnerability. Default Spring AI configurations are vulnerable if using Cosmos DB - no special non-default settings increase risk.

This vulnerability presents significant real-world risk for organizations using Spring AI with Cosmos DB vector stores in production. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity, though authentication is required (PR:L). The attacker needs valid credentials to the application using CosmosDBVectorStore, which could be low-privilege user accounts depending on application design. No EPSS score or KEV listing is available, suggesting no confirmed widespread exploitation at time of analysis, but the technical simplicity (AC:L) and complete CIA impact (H/H/H) make this attractive for post-authentication privilege escalation. The vulnerability is particularly concerning for multi-tenant AI applications where authenticated users should have isolated data access - SQL injection bypasses application-layer access controls entirely. No public exploit code is identified in available data, but SQL injection is well-understood and easily weaponized once vulnerability details are published. Organizations using affected versions in production should prioritize patching, especially if the vector store contains sensitive data or if low-privilege users can control document IDs.

An authenticated attacker with low-privilege access to an AI application using Spring AI's CosmosDBVectorStore crafts a malicious document ID containing SQL injection payloads, such as "'; DROP TABLE embeddings; --" or "' UNION SELECT username, password, api_key FROM users--". When the application processes this document ID through vector store operations (insert, update, or search), the unsanitized ID is embedded directly into SQL queries sent to Cosmos DB. The attacker's injected SQL executes with the application's database privileges, enabling extraction of sensitive vector embeddings, user data, or API keys stored in the database, modification of AI model data to poison results, or destruction of database tables causing application-wide denial of service.