CVE-2026-22729: Spring AI Auth Bypass Vulnerability

CVE-2026-22729 Overview

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.

This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.

Critical Impact

Attackers can bypass access controls and retrieve unauthorized documents by injecting malicious JSONPath expressions, potentially exposing sensitive data across tenant boundaries.

Affected Products

• Spring AI applications using AbstractFilterExpressionConverter
• Vector store implementations with metadata-based filtering
• Multi-tenant applications relying on filter expressions for access control

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-22729 published to NVD
• 2026-03-18 - Last updated in NVD database

Technical Details for CVE-2026-22729

Vulnerability Analysis

This vulnerability is classified under CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement), commonly referred to as Expression Language Injection. The flaw exists in how Spring AI's AbstractFilterExpressionConverter handles user-supplied values when constructing JSONPath queries for vector store operations.

The core issue stems from insufficient input sanitization when filter expressions are built dynamically. Applications that use FilterExpressionBuilder to create metadata queries incorporate user-controlled values directly into JSONPath strings without escaping special characters. This design flaw enables attackers to break out of the intended query context and inject their own JSONPath logic.

The vulnerability has significant implications for multi-tenant architectures where metadata filtering serves as a security boundary. An attacker authenticated to one tenant could craft malicious filter expressions to access documents belonging to other tenants or bypass role-based access control restrictions entirely.

Root Cause

The root cause lies in the improper handling of special characters within filter expression values. When user-supplied input is passed to the FilterExpressionBuilder, characters such as ", ||, and && are not escaped before being inserted into JSONPath queries. This allows these characters to be interpreted as JSONPath operators rather than literal string values, fundamentally altering the query logic.

The AbstractFilterExpressionConverter class and its implementations fail to implement proper output encoding for the JSONPath context, violating secure coding principles for query construction.

Attack Vector

The attack is network-accessible and requires no special privileges beyond basic authentication. An attacker can exploit this vulnerability by:

1. Identifying application endpoints that accept filter expressions or search criteria
2. Crafting malicious input containing JSONPath injection payloads with special characters
3. Submitting the crafted input through the application's normal API interfaces
4. The malicious JSONPath logic executes against the vector store, returning unauthorized documents

The vulnerability enables horizontal access control bypass, allowing attackers to access resources belonging to other users or tenants. The injection technique manipulates the logical structure of metadata queries, causing the filter to match documents that should be restricted.

For detailed technical information about the vulnerability mechanism and affected code paths, refer to the Spring Security Advisory CVE-2026-22729.

Detection Methods for CVE-2026-22729

Indicators of Compromise

• Unusual filter expressions in application logs containing JSONPath special characters (||, &&, ")
• Unexpected query patterns in vector store access logs showing access to documents outside normal user scope
• Authentication logs showing users accessing resources from different tenants or security contexts

Detection Strategies

• Implement input validation rules to detect and alert on filter expressions containing JSONPath operators
• Monitor vector store query logs for anomalous access patterns or cross-tenant document retrieval
• Deploy web application firewall (WAF) rules to detect JSONPath injection payloads in request parameters
• Enable detailed logging for FilterExpressionBuilder operations to capture suspicious input patterns

Monitoring Recommendations

• Configure alerts for filter expressions exceeding normal length thresholds or containing multiple special characters
• Establish baseline metrics for per-user or per-tenant document access patterns and alert on deviations
• Monitor application error logs for JSONPath parsing errors that may indicate injection attempts

How to Mitigate CVE-2026-22729

Immediate Actions Required

• Review all code paths that use FilterExpressionBuilder or AbstractFilterExpressionConverter with user-supplied input
• Implement strict input validation to reject filter values containing special JSONPath characters
• Apply patches from Spring AI as soon as they become available
• Consider implementing additional authorization checks at the document retrieval layer

Patch Information

Refer to the Spring Security Advisory CVE-2026-22729 for official patch information and updated versions. Organizations should monitor Spring's security announcements for remediation guidance and apply updates as soon as they are released.

Workarounds

• Implement a whitelist-based input validation layer that only allows alphanumeric characters in filter expression values
• Add server-side authorization checks that verify document access permissions independently of filter expressions
• Consider implementing prepared statement-style parameterization for filter queries if supported by your vector store
• Temporarily disable user-controlled metadata filtering functionality until patches are applied

To implement input validation for filter expression values, ensure that user-supplied filter values are sanitized by escaping or rejecting special characters before they are passed to FilterExpressionBuilder. Consult the Spring Security Advisory for specific implementation guidance appropriate to your application architecture.