Spring AI EUVD-2026-28875

Exploitation requires applications using Spring AI's MilvusVectorStore component where the doDelete(List) method is invoked with document IDs derived from untrusted sources such as user input, API parameters, or external data feeds. The vulnerability is specific to delete operations on Milvus vector databases-other vector store implementations in Spring AI (Pinecone, Weaviate, Redis, etc.) are not affected by this particular injection flaw. Applications that only use hardcoded or internally-generated document IDs, or that do not expose delete functionality to end users, are not exploitable despite running vulnerable Spring AI versions. The attack requires network access to the application's API or interface that triggers vector store delete operations, but no authentication is required per the CVSS vector (PR:N), meaning publicly-accessible endpoints are at highest risk.

CVSS 8.6 indicates critical severity with remote exploitation requiring no authentication (AV:N/AC:L/PR:N/UI:N), enabling high confidentiality impact and limited integrity/availability impacts. The network attack vector and low complexity suggest ease of exploitation once the attack pattern is understood. However, real-world risk depends heavily on deployment context: this vulnerability only affects applications using Spring AI's MilvusVectorStore with externally-controlled document IDs in delete operations. EPSS and KEV data not provided, suggesting no widespread exploitation detected yet. The Java-specific nature and relatively niche use case (vector database integrations in AI applications) limits attack surface compared to vulnerabilities in core web frameworks. Primary risk is to organizations deploying RAG systems or AI agents that allow user-supplied identifiers for document management operations. The combination of high CVSS but specialized attack surface suggests prioritization should focus on confirming whether MilvusVectorStore delete operations are exposed to untrusted input in your environment.

An attacker identifies a RAG-enabled application using Spring AI's MilvusVectorStore where users can delete their uploaded documents by ID. The attacker crafts a malicious document ID containing Milvus filter expression syntax (e.g., 'valid_id) OR (1==1') and submits it to the delete endpoint. The unsanitized ID is incorporated into the MilvusVectorStore filter expression, causing the injected logic to execute and delete unintended documents across the vector database or exfiltrate metadata about other users' embeddings through filter-based queries.