Spring AI vector store metadata filtering to handle special characters in Elasticsearch…
Priority MEDIUM 43CWE-943Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Fix Fixed Spring AI (Spring): 1.0.9, 1.1.8org.springframework.ai:spring-ai-opensearch-store (Maven): 1.0.9, 1.1.8+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring AI | 1.0.0 to before 1.0.9; 1.1.0 to before 1.1.8 | 1.0.9, 1.1.8 | Patch available | CNA |
| — | org.springframework.ai:spring-ai-opensearch-store (Maven) | 1.0.0 to before 1.0.9 | 1.0.9 | Patch available | GHSA-cmwh-w62w-r2mf |
| — | org.springframework.ai:spring-ai-opensearch-store (Maven) | 1.1.0 to before 1.1.8 | 1.1.8 | Patch available | GHSA-cmwh-w62w-r2mf |
| — | org.springframework.ai:spring-ai-elasticsearch-store (Maven) | 1.0.0 to before 1.0.9 | 1.0.9 | Patch available | GHSA-cmwh-w62w-r2mf |
| — | org.springframework.ai:spring-ai-elasticsearch-store (Maven) | 1.1.0 to before 1.1.8 | 1.1.8 | Patch available | GHSA-cmwh-w62w-r2mf |
| — | org.springframework.ai:spring-ai-gemfire-store (Maven) | 1.0.0 to before 1.0.9 | 1.0.9 | Patch available | GHSA-cmwh-w62w-r2mf |
| — | org.springframework.ai:spring-ai-gemfire-store (Maven) | 1.1.0 to before 1.1.8 | 1.1.8 | Patch available | GHSA-cmwh-w62w-r2mf |
- Spring AI VendorVMware Affected 1.0.0 to before 1.0.9; 1.1.0 to before 1.1.8 Fixed in 1.0.9, 1.1.8 Patch available CNA
- org.springframework.ai:spring-ai-opensearch-store (Maven) Vendor— Affected 1.0.0 to before 1.0.9 Fixed in 1.0.9 Patch available GHSA-cmwh-w62w-r2mf
- org.springframework.ai:spring-ai-opensearch-store (Maven) Vendor— Affected 1.1.0 to before 1.1.8 Fixed in 1.1.8 Patch available GHSA-cmwh-w62w-r2mf
- org.springframework.ai:spring-ai-elasticsearch-store (Maven) Vendor— Affected 1.0.0 to before 1.0.9 Fixed in 1.0.9 Patch available GHSA-cmwh-w62w-r2mf
- org.springframework.ai:spring-ai-elasticsearch-store (Maven) Vendor— Affected 1.1.0 to before 1.1.8 Fixed in 1.1.8 Patch available GHSA-cmwh-w62w-r2mf
- org.springframework.ai:spring-ai-gemfire-store (Maven) Vendor— Affected 1.0.0 to before 1.0.9 Fixed in 1.0.9 Patch available GHSA-cmwh-w62w-r2mf
- org.springframework.ai:spring-ai-gemfire-store (Maven) Vendor— Affected 1.1.0 to before 1.1.8 Fixed in 1.1.8 Patch available GHSA-cmwh-w62w-r2mf
Remediation
- Fix · CNA Spring AI (Spring) Fixed in 1.0.9, 1.1.8
- Fix · GHSA-cmwh-w62w-r2mf org.springframework.ai:spring-ai-opensearch-store (Maven) Fixed in 1.0.9 Advisory →
- Fix · GHSA-cmwh-w62w-r2mf org.springframework.ai:spring-ai-opensearch-store (Maven) Fixed in 1.1.8 Advisory →
- Fix · GHSA-cmwh-w62w-r2mf org.springframework.ai:spring-ai-elasticsearch-store (Maven) Fixed in 1.0.9 Advisory →
- Fix · GHSA-cmwh-w62w-r2mf org.springframework.ai:spring-ai-elasticsearch-store (Maven) Fixed in 1.1.8 Advisory →
- Fix · GHSA-cmwh-w62w-r2mf org.springframework.ai:spring-ai-gemfire-store (Maven) Fixed in 1.0.9 Advisory →
- Fix · GHSA-cmwh-w62w-r2mf org.springframework.ai:spring-ai-gemfire-store (Maven) Fixed in 1.1.8 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47835
- 2026-10-03 Alias added: GHSA-cmwh-w62w-r2mf
References
Other 5
- https://github.com/spring-projects/spring-ai/commit/2b20cfc8f478444f942d4be7a867d254441ff991
- https://github.com/spring-projects/spring-ai/commit/9787991aa1ed92c511131ddf4e142bd94051e6e7
- https://github.com/spring-projects/spring-ai
- https://github.com/spring-projects/spring-ai/releases/tag/v1.0.9
- https://github.com/spring-projects/spring-ai/releases/tag/v1.1.8
More VMware Spring Ai vulnerabilities
- TI-2026-18262 SpEL Injection via Unescaped Filter Key in SimpleVectorStore Leads to Remote Code Execution CVSS 3.1CRITICAL 9.8
- TI-2026-29618 Code injection in VMware Spring AI CVSS 3.1HIGH 8.6
- TI-2026-18254 CVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverter CVSS 3.1HIGH 8.6
- TI-2026-30221 Expression language injection in VMware Spring AI CVSS 3.1HIGH 8.6
- TI-2026-18266 Server-Side Request Forgery in BedrockProxyChatModel via Unvalidated Media URL Fetching CVSS 3.1HIGH 8.6
- TI-2026-42449 DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-47835 · CVE Program
- CVE-2026-47835 · NVD
- FIRST EPSS
- GHSA-cmwh-w62w-r2mf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences