CVE-2026-47835: Spring AI Vector Store Query Injection (CVSS 8.6)

Technical summary

The vulnerability is a query injection flaw (CWE-943) in Spring AI's vector store abstraction layer. The affected components—spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store—fail to properly sanitize user-controlled input before constructing database queries. An unauthenticated network attacker can leverage special characters to bypass query parsing logic and inject malicious query syntax, leading to unintended query execution against the underlying vector database. The lack of input controls allows both confidentiality and integrity compromise of indexed vector data.

Business impact

Organizations using Spring AI for vector database operations face exposure of sensitive embeddings and indexed data, potential manipulation of vector search results, and service disruption through resource-intensive injected queries. If vector stores contain proprietary models, training data, or confidential information, unauthorized disclosure is possible. The network-accessible nature and lack of authentication requirement elevates risk for organizations with internet-facing applications, particularly those using vector stores for retrieval-augmented generation (RAG) systems or similarity search in production workloads.

Affected systems

Spring AI versions 1.0.0 through 1.0.8 and 1.1.0 through 1.1.7 are affected when deployed with Elasticsearch, OpenSearch, or GemFire VectorDB as the vector store backend. The vulnerability is introduced in the vector store client libraries and affects any application linking spring-ai-elasticsearch-store, spring-ai-opensearch-store, or spring-ai-gemfire-store dependencies at these version ranges. Downstream applications embedding these libraries inherit the risk regardless of framework.

Exploitability

This vulnerability has a CVSS 3.1 score of 8.6 (HIGH) with a network attack vector, low complexity, and no authentication or user interaction required. The attack is straightforward: an attacker sends a crafted request containing injection characters to a Spring AI endpoint that queries the vector store. No special privileges, exploit reliability, or unusual conditions are needed. Public vector databases exposed on the internet or accessible within corporate networks are directly exploitable. However, the vulnerability is not yet in the KEV (Known Exploited Vulnerabilities) catalog, meaning active in-the-wild exploitation has not been confirmed by CISA as of the publication date.

Remediation

Upgrade to Spring AI 1.0.9 or later for the 1.0.x line, or Spring AI 1.1.8 or later for the 1.1.x line. These versions include input sanitization and query construction fixes that prevent injection attacks. No workarounds are available short of upgrading. Verify the patch version against the official VMware Spring AI release notes before deployment.

Patch guidance

For Maven projects: update the spring-ai-dependencies BOM and/or individual vector store artifacts (spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store) to version 1.0.9+ or 1.1.8+ depending on your minor version line. For Gradle projects, update the corresponding version constraints. Test the upgrade in a non-production environment first, particularly if you have custom vector store query logic or rely on undocumented query syntax. Review Spring AI release notes for any breaking changes or deprecations in the target version.

Detection guidance

Monitor application logs for unusual query patterns or malformed queries sent to your Elasticsearch, OpenSearch, or GemFire instances. Look for requests containing special characters (quotes, braces, wildcards) in unexpected positions within vector search payloads. Network-level detection should flag requests to vector store ports (9200 for Elasticsearch, 9300 for OpenSearch cluster communication) with injection-like payloads. Endpoint Detection and Response (EDR) tools should monitor Spring AI process spawning unusual subprocess activity or accessing unexpected files. Inventory your Spring AI dependencies: grep your pom.xml or build.gradle files for spring-ai-elasticsearch-store, spring-ai-opensearch-store, or spring-ai-gemfire-store and confirm versions against 1.0.9+ or 1.1.8+.

Why prioritize this

HIGH priority for any organization using Spring AI with vector database backends in production or internet-facing deployments. The unauthenticated, network-exploitable nature combined with potential for data exposure and integrity compromise justifies immediate patching. Organizations using vector stores for confidential data (proprietary models, customer information) should prioritize within 48 hours. Lower priority for development/lab environments or isolated internal deployments, but upgrade should still occur during the next maintenance window.

Risk score, explained

CVSS 8.6 reflects the ease of exploitation (network, no auth), the broad scope of affected functionality (vector query execution), and the impact on confidentiality (data disclosure) and integrity (query manipulation). The score is not critical (9.0+) because the attack is limited to vector store operations and does not directly grant system-level access or availability compromise at scale. However, the practical severity is amplified by the prevalence of vector databases in modern AI/ML pipelines and the sensitivity of embedded data.

Frequently asked questions