CVE-2026-40979: Spring AI Information Disclosure Flaw

CVE-2026-40979 Overview

CVE-2026-40979 is a medium-severity information disclosure vulnerability in VMware Spring AI that allows attackers with access to a shared environment to expose the ONNX (Open Neural Network Exchange) model used by the application. This vulnerability stems from insecure temporary file handling practices (CWE-377), potentially enabling unauthorized access to proprietary machine learning models and their associated intellectual property.

Critical Impact

Attackers with local access to shared environments can gain unauthorized access to ONNX models, potentially exposing proprietary AI/ML intellectual property and enabling model theft or reverse engineering attacks.

Affected Products

• VMware Spring AI versions 1.0.0 through 1.0.5
• VMware Spring AI versions 1.1.0 through 1.1.4
• Applications using affected Spring AI versions in shared or multi-tenant environments

Discovery Timeline

• 2026-04-28 - CVE-2026-40979 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-40979

Vulnerability Analysis

This vulnerability in Spring AI relates to insecure temporary file handling (CWE-377: Insecure Temporary File) when managing ONNX model files. In shared computing environments such as multi-tenant cloud deployments or containerized applications with shared file systems, the application may expose ONNX model files through predictable file locations or insufficient access controls on temporary storage.

The vulnerability requires local access to exploit, meaning an attacker must already have some level of access to the shared environment where the vulnerable Spring AI application is running. The attack complexity is low once access is established, and no user interaction is required for exploitation. While confidentiality impact is limited, the integrity impact is high, as attackers could potentially modify or replace model files.

Root Cause

The root cause of CVE-2026-40979 lies in how Spring AI handles ONNX model files in temporary storage locations. The framework creates temporary files with insufficient access restrictions, allowing other users or processes in shared environments to read or modify these model files. This is a classic insecure temporary file vulnerability where the application fails to properly secure transient data that contains sensitive intellectual property.

Attack Vector

The attack vector is local, requiring an attacker to have access to the same shared environment where the vulnerable Spring AI application operates. Exploitation scenarios include:

1. Multi-tenant cloud environments - Attackers on shared infrastructure could access temporary directories where ONNX models are stored
2. Containerized deployments - In environments with shared volumes or insufficient container isolation, neighboring containers may access model files
3. Development/staging systems - Shared development environments where multiple users have access to the same file system

The vulnerability allows attackers to extract ONNX model files, potentially enabling reverse engineering of proprietary AI models, intellectual property theft, or modification of model files to introduce adversarial behavior.

Detection Methods for CVE-2026-40979

Indicators of Compromise

• Unexpected file access attempts in temporary directories containing .onnx files
• Anomalous read operations on Spring AI model storage locations by non-application processes
• File permission changes on ONNX model files or their parent directories
• Unusual process access patterns to /tmp or application-specific temporary directories

Detection Strategies

• Monitor file system access logs for unauthorized access to directories used by Spring AI
• Implement file integrity monitoring (FIM) on ONNX model storage locations
• Use application-level logging to track model loading and unloading events
• Deploy endpoint detection and response (EDR) solutions to identify suspicious file access patterns

Monitoring Recommendations

• Configure audit logging for all access to temporary directories used by Spring AI applications
• Implement alerting for file access by unexpected user accounts or processes
• Review container isolation configurations in Kubernetes or Docker deployments
• Monitor for lateral movement attempts following potential model exfiltration

How to Mitigate CVE-2026-40979

Immediate Actions Required

• Upgrade Spring AI to version 1.0.6 or later for the 1.0.x branch
• Upgrade Spring AI to version 1.1.5 or later for the 1.1.x branch
• Review and restrict file system permissions on directories containing ONNX models
• Audit shared environment access controls to minimize exposure

Patch Information

VMware has released security patches addressing this vulnerability. Affected users should upgrade to the fixed versions:

• Spring AI 1.0.x users: Upgrade to version 1.0.6 or later
• Spring AI 1.1.x users: Upgrade to version 1.1.5 or later

For detailed patch information and upgrade instructions, refer to the Spring Security Advisory for CVE-2026-40979.

Workarounds

• Implement strict file system permissions (e.g., chmod 600) on ONNX model files and their containing directories
• Use dedicated, isolated storage volumes for AI model files rather than shared temporary directories
• Deploy Spring AI applications in isolated containers with no shared volumes
• Consider encrypting ONNX model files at rest using application-level encryption

# Restrict permissions on ONNX model directories
chmod 700 /path/to/model/directory
chmod 600 /path/to/model/directory/*.onnx

# Ensure proper ownership
chown appuser:appgroup /path/to/model/directory -R