CVE-2026-40967: VMware Spring AI RCE Vulnerability

CVE-2026-40967 Overview

CVE-2026-40967 is a code injection vulnerability affecting VMware Spring AI's FilterExpressionConverter implementations. Various FilterExpressionConverter implementations accept filter expression objects and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability for attackers to alter the query and potentially access or modify unauthorized data.

Critical Impact

Attackers can exploit improper input escaping in FilterExpressionConverter implementations to inject malicious query syntax, potentially compromising data confidentiality and integrity within vector store backends.

Affected Products

• VMware Spring AI versions 1.0.0 through 1.0.5
• VMware Spring AI versions 1.1.0 through 1.1.4

Discovery Timeline

• 2026-04-28 - CVE-2026-40967 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-40967

Vulnerability Analysis

This vulnerability stems from CWE-94 (Improper Control of Generation of Code), commonly known as code injection. The Spring AI framework provides FilterExpressionConverter implementations that translate filter expression objects into query languages used by various vector store backends. These converters fail to properly sanitize and escape user-supplied keys and values before incorporating them into the generated queries.

When applications using Spring AI accept untrusted input as part of filter expressions, attackers can craft malicious input containing special characters or query syntax elements. Since the converters do not adequately escape these inputs, the malicious content gets interpreted as part of the query structure rather than as literal data values. This allows attackers to modify query logic, potentially accessing data they should not be authorized to view or manipulating query results.

The network-accessible nature of this vulnerability means that remote attackers can exploit it without requiring authentication or user interaction, making it particularly dangerous in production environments that expose Spring AI-powered applications to untrusted users.

Root Cause

The root cause of CVE-2026-40967 lies in the insufficient input validation and output encoding within multiple FilterExpressionConverter implementations in Spring AI. The converters directly interpolate user-controlled keys and values into query strings without applying appropriate escaping mechanisms specific to each vector store's query language syntax. This failure to implement proper output encoding allows specially crafted input to break out of the intended data context and inject arbitrary query commands.

Attack Vector

The attack vector for this vulnerability is network-based with low attack complexity. An attacker can exploit this vulnerability by:

1. Identifying an application endpoint that passes user-controlled input to Spring AI's filter expression processing
2. Crafting malicious filter expression values containing query language escape sequences or special characters
3. Submitting the malicious input through the network interface
4. The FilterExpressionConverter processes the input without proper escaping, allowing the injected content to alter the query structure
5. The modified query executes against the vector store, potentially exposing unauthorized data or altering query behavior

The vulnerability does not require authentication or privileges to exploit, and no user interaction is needed, making it exploitable in fully automated attack scenarios.

Detection Methods for CVE-2026-40967

Indicators of Compromise

• Unusual or malformed query patterns in vector store query logs containing unexpected special characters or query operators
• Application errors or exceptions related to FilterExpressionConverter processing that indicate injection attempts
• Unexpected data access patterns showing queries returning data outside normal user access boundaries
• Audit log entries showing filter expressions with injection payloads such as quote characters, boolean operators, or query language keywords

Detection Strategies

• Implement application-level logging for all filter expression inputs passed to Spring AI components and monitor for suspicious patterns
• Deploy Web Application Firewall (WAF) rules to detect and block common injection patterns in request parameters
• Configure runtime application security testing (RASP) solutions to monitor FilterExpressionConverter method invocations for malicious inputs
• Review vector store access logs for queries with unusual structure or unauthorized data access patterns

Monitoring Recommendations

• Enable verbose logging for Spring AI filter expression processing in development and staging environments to identify potential injection vectors
• Set up alerting for application exceptions originating from FilterExpressionConverter classes that may indicate injection attempts
• Monitor vector store query performance metrics for anomalies that could indicate successful query manipulation attacks

How to Mitigate CVE-2026-40967

Immediate Actions Required

• Upgrade Spring AI to version 1.0.6 or later for applications using the 1.0.x branch
• Upgrade Spring AI to version 1.1.5 or later for applications using the 1.1.x branch
• Audit existing code for any user-controlled input being passed to FilterExpressionConverter implementations
• Implement input validation at the application layer to restrict filter expression keys and values to expected formats

Patch Information

VMware has released security patches addressing this vulnerability. Spring AI version 1.0.6 contains the fix for the 1.0.x release branch, while version 1.1.5 contains the fix for the 1.1.x release branch. The patches implement proper escaping of keys and values within FilterExpressionConverter implementations to prevent query injection attacks. For detailed patch information and upgrade guidance, refer to the Spring Security Advisory.

Workarounds

• Implement strict input validation on all user-supplied data before passing it to Spring AI filter expression processing, rejecting any input containing special characters or query syntax elements
• Use an allowlist approach to restrict filter expression keys to predefined values rather than accepting arbitrary user input
• Deploy network-level controls to limit access to affected application endpoints while awaiting patch deployment
• Consider temporarily disabling filter expression functionality that accepts user input until patches can be applied