CVE-2026-40966: VMware Spring AI Auth Bypass Vulnerability

CVE-2026-40966 Overview

CVE-2026-40966 is an authorization bypass vulnerability in VMware Spring AI that allows attackers to bypass conversation isolation mechanisms and exfiltrate sensitive memory from other users' chat histories. The vulnerability affects applications using VectorStoreChatMemoryAdvisor that pass user-supplied input as a conversationId, enabling malicious actors to inject filter logic and access sensitive data including secrets and credentials from other users' conversations.

Critical Impact

Attackers can access sensitive chat histories containing secrets and credentials from other users by exploiting improper access control in the conversation memory system.

Affected Products

• VMware Spring AI (versions using VectorStoreChatMemoryAdvisor)
• Applications passing user-supplied input as conversationId

Discovery Timeline

• 2026-04-28 - CVE-2026-40966 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-40966

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) in Spring AI's conversation memory management system. The VectorStoreChatMemoryAdvisor component fails to properly validate and sanitize the conversationId parameter before using it in filter operations against the underlying vector store. When applications accept user-supplied input as a conversationId, attackers can craft malicious payloads that manipulate the filter logic.

The attack requires specific conditions: the target application must use VectorStoreChatMemoryAdvisor and must pass user-controlled input directly as the conversation identifier. While the attack complexity is high, successful exploitation requires no privileges and results in high confidentiality impact, as attackers can access sensitive conversation data belonging to other users.

Root Cause

The root cause is improper access control in the VectorStoreChatMemoryAdvisor component. The system does not adequately enforce conversation isolation boundaries when processing the conversationId parameter. Instead of treating the identifier as an opaque reference, the component allows injection of filter logic that can modify query behavior, effectively bypassing the intended isolation between user conversations.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication. An attacker targets applications that expose conversation functionality using Spring AI's memory advisor system. By providing specially crafted conversationId values, the attacker can inject filter expressions that alter the vector store queries, allowing retrieval of chat history entries from conversations they should not have access to.

The attack flow typically involves:

1. Identifying a Spring AI application using VectorStoreChatMemoryAdvisor
2. Locating input fields or API parameters that accept conversation identifiers
3. Injecting malicious filter logic through the conversationId parameter
4. Extracting sensitive memory content from other users' chat histories

For detailed technical information, refer to the Spring Security Advisory.

Detection Methods for CVE-2026-40966

Indicators of Compromise

• Unusual patterns in conversationId parameters containing filter syntax or special characters
• Unexpected vector store query patterns accessing cross-conversation data
• Application logs showing conversation memory retrieval for non-existent or mismatched user sessions
• Anomalous data access patterns where single users retrieve disproportionate amounts of chat history

Detection Strategies

• Monitor and log all conversationId parameters for unexpected characters or filter syntax patterns
• Implement input validation alerts for conversation identifiers that deviate from expected formats (UUIDs, sequential IDs)
• Deploy application-layer intrusion detection rules targeting filter injection patterns in Spring AI contexts
• Audit vector store query logs for queries that return results across multiple conversation boundaries

Monitoring Recommendations

• Enable detailed logging for VectorStoreChatMemoryAdvisor operations including all query parameters
• Set up alerting on conversation memory access patterns that span multiple user sessions
• Monitor for elevated error rates or exceptions in the conversation memory retrieval code path
• Track and baseline normal conversation access patterns to identify anomalous behavior

How to Mitigate CVE-2026-40966

Immediate Actions Required

• Review all applications using Spring AI's VectorStoreChatMemoryAdvisor to identify vulnerable configurations
• Audit code paths where conversationId is accepted from user input
• Implement strict input validation for conversation identifiers, allowing only expected formats
• Consider temporarily disabling affected functionality until patches are applied
• Apply the vendor security patch as soon as available

Patch Information

VMware has released a security advisory addressing this vulnerability. Review the Spring Security Advisory for CVE-2026-40966 for official patch information and updated versions. Upgrade to the patched version of Spring AI as specified in the vendor advisory.

Workarounds

• Do not pass user-supplied input directly as the conversationId parameter
• Generate conversation identifiers server-side using secure random UUIDs instead of accepting user input
• Implement a mapping layer between external conversation references and internal identifiers
• Add strict input validation that rejects any conversationId containing special characters or filter syntax
• Apply allowlist validation ensuring conversation IDs match expected patterns (alphanumeric, specific length)

# Example: Validate conversationId format before use
# Ensure conversationId matches UUID format only
if [[ ! "$CONVERSATION_ID" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]]; then
    echo "Invalid conversation ID format - rejecting request"
    exit 1
fi