Medium severity · published Apr 28, 2026
CVE-2026-40966
VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration
5.9
CVSS
0.2%
EPSS
No
On KEV
Description
In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Spring AI · VMware
1.0.0 before 1.0.6; 1.1.0 before 1.1.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40966
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40966
US Government Resource
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Vendor Advisory
https://spring.io/security/cve-2026-40966
More from Spring AI
9.8
CVE-2026-59318
DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection
9.8
CVE-2026-22738
SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution
8.8
CVE-2026-40978
SQL injection vulnerability in Spring AI's `CosmosDBVectorStore` allows attackers to execute arbitrary SQL queries via crafted document IDs
8.8
CVE-2026-22730
CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter
8.6
CVE-2026-41705
Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs