CVE-2026-22738: Spring AI SpEL Injection RCE Vulnerability

CVE-2026-22738 Overview

A critical SpEL (Spring Expression Language) injection vulnerability has been identified in Spring AI's SimpleVectorStore component. This vulnerability allows remote attackers to execute arbitrary code when user-supplied values are used as filter expression keys without proper sanitization. Applications leveraging Spring AI's vector storage capabilities that accept user input for filter expressions are at risk of complete system compromise.

Critical Impact

Remote attackers can achieve arbitrary code execution on affected systems by exploiting improper handling of user-supplied filter expression keys in SimpleVectorStore, potentially leading to complete system compromise.

Affected Products

• Spring AI versions 1.0.0 through 1.0.4
• Spring AI versions 1.1.0 through 1.1.3

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-22738 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-22738

Vulnerability Analysis

This vulnerability stems from insufficient input validation in Spring AI's SimpleVectorStore component when processing filter expressions. The SimpleVectorStore is used for vector similarity searches in AI applications, commonly employed in retrieval-augmented generation (RAG) architectures and semantic search implementations.

When an application passes user-controlled data as a filter expression key, the SpEL expression evaluator processes this input without adequate sanitization. Spring Expression Language is a powerful expression language that supports querying and manipulating object graphs at runtime. If an attacker can inject malicious SpEL expressions, they can leverage SpEL's runtime execution capabilities to invoke arbitrary methods, access class loaders, and execute system commands.

The attack surface is significant because Spring AI is increasingly adopted for building AI-powered applications, and vector stores are central to many modern AI architectures. Applications that implement search filtering based on user preferences or dynamic query parameters are particularly vulnerable.

Root Cause

The root cause of this vulnerability is the improper handling of user-supplied input when constructing SpEL filter expressions in SimpleVectorStore. The filter expression key parameter is directly incorporated into SpEL evaluation without proper validation or escaping, allowing attackers to break out of the intended expression context and inject arbitrary SpEL code.

SpEL injection vulnerabilities typically occur when:

• User input is concatenated directly into expression strings
• No allowlist validation is performed on expression components
• The expression evaluator has access to dangerous runtime capabilities

Attack Vector

This vulnerability is exploitable remotely over the network. An attacker can craft malicious HTTP requests containing SpEL payloads within filter expression keys. When the application processes these requests through the vulnerable SimpleVectorStore methods, the malicious expressions are evaluated, granting the attacker code execution capabilities.

The attack requires no authentication and no user interaction, making it highly exploitable. A successful exploit could allow an attacker to:

• Execute arbitrary system commands on the server
• Read or modify sensitive data
• Establish persistence mechanisms
• Pivot to other internal systems
• Exfiltrate data from the application and connected databases

Typical SpEL injection payloads leverage Java's Runtime.getRuntime().exec() method or similar reflection-based techniques to execute arbitrary commands. For detailed technical information on the exploitation mechanism, refer to the Spring Security Advisory CVE-2026-22738.

Detection Methods for CVE-2026-22738

Indicators of Compromise

• Unusual process spawning from Java application processes, particularly shell invocations (/bin/sh, cmd.exe, powershell)
• Unexpected outbound network connections from application servers
• Web application logs containing SpEL syntax patterns such as T(java.lang.Runtime), #rt.exec(), or class instantiation expressions
• Error logs indicating SpEL parsing exceptions with user-controlled data

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SpEL injection patterns in request parameters
• Deploy runtime application self-protection (RASP) solutions to monitor for expression language injection attacks
• Configure SentinelOne agents to detect anomalous process execution chains originating from Java processes
• Enable application-level logging for all filter expression evaluations in Spring AI components

Monitoring Recommendations

• Monitor application logs for failed SpEL expression parsing errors that may indicate reconnaissance attempts
• Set up alerts for Java processes spawning child processes or establishing unexpected network connections
• Track changes to system files and configurations that may indicate successful exploitation
• Implement centralized log aggregation to correlate potential exploitation attempts across application instances

How to Mitigate CVE-2026-22738

Immediate Actions Required

• Immediately upgrade Spring AI to version 1.0.5 or later for 1.0.x users, or version 1.1.4 or later for 1.1.x users
• Review application code to identify all instances where user input is passed to SimpleVectorStore filter expressions
• Implement strict input validation on all user-supplied filter expression keys
• Consider temporarily disabling user-controlled filter functionality until patches can be applied

Patch Information

VMware/Pivotal has released patched versions of Spring AI addressing this vulnerability. Users should upgrade to:

• Spring AI 1.0.5 for users on the 1.0.x branch
• Spring AI 1.1.4 for users on the 1.1.x branch

For complete details on the security fix, refer to the Spring Security Advisory CVE-2026-22738.

Workarounds

• Implement allowlist validation for filter expression keys, rejecting any input containing SpEL metacharacters such as #, T(, $, and curly braces
• Use parameterized queries or pre-defined filter templates instead of accepting arbitrary user input for expression keys
• Deploy network segmentation to limit the impact of potential code execution by restricting outbound connections from application servers
• Consider implementing a custom SimpleVectorStore wrapper that sanitizes all filter expression inputs before processing

# Maven dependency update example
# Update your pom.xml to use the patched version:
# For 1.0.x branch:
#   <spring-ai.version>1.0.5</spring-ai.version>
# For 1.1.x branch:
#   <spring-ai.version>1.1.4</spring-ai.version>

# Verify your Spring AI version after update
mvn dependency:tree | grep spring-ai