CVE-2026-40967: Spring AI VectorStore FilterExpression Converter Injection Vulnerability
Summary
CVE-2026-40967: Spring AI has a VectorStore FilterExpression Converter injection. Affects org.springframework.ai:spring-ai-vector-store across 2 version ranges.
>= 1.0.0, < 1.0.6
>= 1.1.0, < 1.1.5
Fixed in 1.0.6 or 1.1.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring AI is a framework designed to facilitate the integration of artificial intelligence capabilities into Java applications. It provides various tools and libraries for working with AI models, including vector stores for managing and querying data. The framework's flexibility and ease of use make it a popular choice among developers. However, certain versions of Spring AI contain a vulnerability in the FilterExpressionConverter implementations that can lead to security risks if not addressed.
Vulnerability Detail
In Spring AI, the FilterExpressionConverter implementations are responsible for translating filter expression objects into specific query languages for vector stores. The vulnerability arises from inadequate escaping of keys and values in these expressions, allowing an attacker to manipulate the query. This could lead to unauthorized data access or modification, posing significant risks to the integrity and confidentiality of the data managed by the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.61.0.6 -
>= 1.1.0, < 1.1.51.1.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, developers can implement input validation and sanitization for filter expressions to mitigate the risk of injection attacks until the package is updated. This involves ensuring that all user inputs are properly escaped before being processed by the FilterExpressionConverter.
Conclusion
The CVE-2026-40967 vulnerability in Spring AI poses significant risks due to improper handling of filter expressions in the VectorStore FilterExpression Converter. It is crucial for users to update to the latest patched versions to mitigate these risks. Additionally, employing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for org.springframework.ai:spring-ai-vector-store →
FAQ
CVE-2026-40967 is a vulnerability in the Spring AI framework that allows for injection attacks through improperly escaped filter expressions in the VectorStore FilterExpression Converter.
The affected versions are Spring AI 1.0.0 to 1.0.5 and 1.1.0 to 1.1.4. The vulnerability has been fixed in versions 1.0.6 and 1.1.5.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using your pom.xml file, you can check if your application is affected by this vulnerability without needing to install any software.
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
If immediate updates are not possible, implement input validation and sanitization for filter expressions to reduce the risk of exploitation until you can upgrade to a secure version.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.ai:spring-ai-vector-store.
