TI-2026-29617 Aliases CVE-2026-40966 GHSA-v6x6-pjxw-3pv2

VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

LOW 26CWE-284Published 2026-04-28 · Updated 2026-04-28

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00233 14th percentileScored 2026-11-07

Fix Fixed Spring AI (VMware): 1.0.6, 1.1.5org.springframework.ai:spring-ai-advisors-vector-store (Maven): 1.0.6, 1.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
VMware	Spring AI	1.0.0 to before 1.0.6; 1.1.0 to before 1.1.5	1.0.6, 1.1.5	Patch available	CNA
—	org.springframework.ai:spring-ai-advisors-vector-store (Maven)	1.0.0 to before 1.0.6	1.0.6	Patch available	GHSA-v6x6-pjxw-3pv2
—	org.springframework.ai:spring-ai-advisors-vector-store (Maven)	1.1.0 to before 1.1.5	1.1.5	Patch available	GHSA-v6x6-pjxw-3pv2

Spring AI VendorVMware Affected 1.0.0 to before 1.0.6; 1.1.0 to before 1.1.5 Fixed in 1.0.6, 1.1.5 Patch available CNA
org.springframework.ai:spring-ai-advisors-vector-store (Maven) Vendor— Affected 1.0.0 to before 1.0.6 Fixed in 1.0.6 Patch available GHSA-v6x6-pjxw-3pv2
org.springframework.ai:spring-ai-advisors-vector-store (Maven) Vendor— Affected 1.1.0 to before 1.1.5 Fixed in 1.1.5 Patch available GHSA-v6x6-pjxw-3pv2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vmware:spring_ai::::::::	1.0.0 to before 1.0.6; 1.1.0 to before 1.1.5	Vulnerable	VMware

cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.0.6; 1.1.0 to before 1.1.5 Vulnerable ·VMware

Remediation

Fix · CNA Spring AI (VMware) Fixed in 1.0.6, 1.1.5
Fix · GHSA-v6x6-pjxw-3pv2 org.springframework.ai:spring-ai-advisors-vector-store (Maven) Fixed in 1.0.6 Advisory →
Fix · GHSA-v6x6-pjxw-3pv2 org.springframework.ai:spring-ai-advisors-vector-store (Maven) Fixed in 1.1.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-40966
2026-10-03 Alias added: GHSA-v6x6-pjxw-3pv2

References

Advisory 2

Other 3

TI-2026-18262 SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
TI-2026-29618 Code injection in VMware Spring AI CVSS 3.1HIGH 8.6
TI-2026-18254 CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter CVSS 3.1HIGH 8.6
TI-2026-35287 Spring AI vector store metadata filtering to handle special characters in Elasticsearch… CVSS 3.1HIGH 8.6
TI-2026-30221 Expression language injection in VMware Spring AI CVSS 3.1HIGH 8.6
TI-2026-18266 Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching CVSS 3.1HIGH 8.6

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences