CVE-2026-22744: Spring AI Redis Store XSS Vulnerability

CVE-2026-22744 Overview

A query injection vulnerability exists in the RedisFilterExpressionConverter component of Spring AI's Redis Store module. When a user-controlled string is passed as a filter value for a TAG field, the stringValue() method inserts the value directly into the @field:{VALUE} RediSearch TAG block without properly escaping special characters. This allows attackers to manipulate RediSearch queries and potentially access unauthorized data.

Critical Impact

Attackers can exploit this vulnerability to bypass intended query restrictions and extract sensitive information from Redis vector stores by injecting malicious filter expressions.

Affected Products

• Spring AI versions 1.0.0 through 1.0.4
• Spring AI versions 1.1.0 through 1.1.3
• Applications using spring-ai-redis-store with user-controlled filter inputs

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-22744 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-22744

Vulnerability Analysis

This vulnerability represents a classic query injection flaw in the Spring AI framework's Redis integration layer. The RedisFilterExpressionConverter class is responsible for converting filter expressions into RediSearch query syntax. The vulnerable stringValue() method fails to sanitize or escape special characters that have semantic meaning in RediSearch's TAG field syntax.

RediSearch TAG fields use curly braces {} to delimit values in queries. When user input containing special characters such as |, }, {, or escape sequences is passed directly into the query template without encoding, attackers can break out of the intended value context and inject arbitrary query predicates.

The network-accessible nature of this vulnerability means that any application exposing Spring AI's vector store search functionality to external users is potentially at risk. Since no privileges are required to exploit this flaw, unauthenticated attackers can attempt injection attacks against vulnerable endpoints.

Root Cause

The root cause is improper input validation and missing output encoding in the stringValue() method of RedisFilterExpressionConverter. The method constructs RediSearch TAG queries using string concatenation without escaping characters that have special meaning in the RediSearch query language. This violates the security principle of treating all user input as untrusted and properly encoding output based on the context where it will be used.

Attack Vector

The attack vector is network-based, requiring an attacker to send crafted filter values through application endpoints that utilize Spring AI's Redis vector store search functionality. An attacker would identify an endpoint that accepts filter parameters for vector similarity searches and then craft malicious input containing RediSearch query syntax to escape the TAG field boundary and inject additional query conditions.

This could allow the attacker to modify the query logic to return records they shouldn't have access to, bypass application-level access controls implemented through filter expressions, or enumerate data across different TAG field values. The attack requires no authentication and can be performed with low complexity, making it accessible to a wide range of threat actors.

Detection Methods for CVE-2026-22744

Indicators of Compromise

• Unusual characters in application logs for Redis filter parameters, including pipe characters (|), curly braces ({}), or backslashes
• Unexpected query patterns in Redis slow logs or query monitoring showing malformed TAG expressions
• Application errors related to RediSearch query parsing failures
• Anomalous data access patterns where users retrieve records outside their normal scope

Detection Strategies

• Implement input validation logging to capture and alert on filter values containing RediSearch special characters
• Deploy application-level WAF rules to detect query injection patterns in request parameters targeting vector search endpoints
• Enable Redis command auditing to monitor for suspicious FT.SEARCH commands with unusual syntax patterns
• Establish baseline metrics for vector store query behavior to identify deviation patterns

Monitoring Recommendations

• Configure alerting for RediSearch query errors that may indicate injection attempts
• Monitor application endpoints accepting filter parameters for unusual request volumes or patterns
• Implement logging correlation between web application requests and Redis commands to trace malicious activity
• Review Spring AI debug logs for filter expression conversion anomalies

How to Mitigate CVE-2026-22744

Immediate Actions Required

• Upgrade Spring AI to version 1.0.5 or later for the 1.0.x branch
• Upgrade Spring AI to version 1.1.4 or later for the 1.1.x branch
• Audit all code paths where user input flows into Redis vector store filter expressions
• Implement application-level input validation for filter parameters as defense-in-depth

Patch Information

VMware has released patched versions of Spring AI that properly escape special characters in TAG field values. The fix is available in Spring AI 1.0.5 and 1.1.4. Organizations should prioritize upgrading to these versions. For detailed information about the security fix, refer to the Spring Security Advisory CVE-2026-22744.

Workarounds

• Implement strict input validation at the application layer to reject filter values containing RediSearch special characters such as |, {, }, and \
• Use allowlist validation for filter field values where possible, accepting only expected patterns
• Deploy a reverse proxy or WAF rule to sanitize incoming requests before they reach the application
• Consider temporarily disabling user-controlled filtering for Redis vector stores until the patch can be applied

The recommended approach is to validate filter inputs at the application boundary before passing them to Spring AI:

// Input validation example for filter values
public String sanitizeFilterValue(String input) {
    // Reject inputs containing RediSearch special characters
    if (input != null && input.matches(".*[|{}\\\\].*")) {
        throw new IllegalArgumentException("Invalid filter value");
    }
    return input;
}