What’s Vulnerable › Vulnerabilities

CVE-2026-40966: VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-28 · updated 2026-10-26
• Weakness: CWE-284

Description

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.

Affected products

• Spring AI: from 1.0.0 before 1.0.6; from 1.1.0 before 1.1.5 — fixed in 1.0.6, 1.1.5
• Spring AI: from 1.0.0 before 1.0.6; from 1.1.0 before 1.1.5 — fixed in 1.0.6, 1.1.5

How to fix

Upgrade to a fixed version: Spring AI 1.0.6, 1.1.5; Spring AI 1.0.6, 1.1.5. Check the vendor advisory for mitigations.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
• https://spring.io/security/cve-2026-40966

Get alerted when CVE-2026-40966 or the next vulnerability affects your stack