CVE-2026-47835 Overview
CVE-2026-47835 is a query injection vulnerability in Spring AI Vector Stores. Special characters in user-supplied input can force execution of arbitrary queries against Elasticsearch, OpenSearch, and GemFire VectorDB backends. The flaw affects the spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store components. Attackers can exploit the vulnerability remotely over the network without authentication or user interaction. Successful exploitation enables unauthorized data retrieval from vector store backends. The vulnerability is tracked under CWE-943: Improper Neutralization of Special Elements in Data Query Logic.
Critical Impact
Unauthenticated remote attackers can inject crafted input to execute arbitrary queries against backing vector databases, exposing sensitive embedded data.
Affected Products
- Spring AI 1.0.0 through 1.0.8 (fixed in 1.0.9)
- Spring AI 1.1.0 through 1.1.7 (fixed in 1.1.8)
- Components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store
Discovery Timeline
- 2026-06-15 - CVE-2026-47835 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-47835
Vulnerability Analysis
The vulnerability resides in Spring AI's vector store integrations for Elasticsearch, OpenSearch, and GemFire VectorDB. These integrations construct backend queries from input strings without adequate neutralization of special characters. Attackers who can influence values passed to similarity search, filter, or metadata operations can break out of the intended query context. The resulting injected query executes with the privileges of the Spring AI application's database connection. Confidentiality of stored embeddings and associated metadata is the primary concern, while integrity and availability are not directly affected per the published CVSS vector.
Root Cause
The affected store implementations build queries by concatenating or interpolating untrusted input into query structures sent to the vector backend. Special characters carry semantic meaning in Elasticsearch Query DSL, OpenSearch Query DSL, and GemFire OQL. Without escaping or parameterization, these characters change query semantics. This pattern matches CWE-943, improper neutralization of special elements used in a query language.
Attack Vector
An attacker submits crafted input through any application surface that ultimately reaches a Spring AI vector store call. Common entry points include retrieval-augmented generation (RAG) chat endpoints, document search APIs, and metadata filter parameters. The injected payload manipulates the constructed query to retrieve documents outside the intended scope or enumerate the vector index. No authentication is required when the application exposes such endpoints publicly. Refer to the Spring Security Advisory for component-specific technical details.
Detection Methods for CVE-2026-47835
Indicators of Compromise
- Anomalous Elasticsearch, OpenSearch, or GemFire query patterns containing unexpected operators, wildcards, or boolean constructs originating from Spring AI application connections.
- Vector store query responses returning unusually large result sets or documents outside the requesting tenant or user scope.
- Application logs showing user-supplied input containing characters such as ", {, }, (, ), or DSL keywords reaching vector store APIs.
Detection Strategies
- Inspect HTTP request payloads to RAG and search endpoints for query DSL metacharacters and structural tokens.
- Compare executed backend queries against expected query templates to identify structural deviations.
- Correlate Spring AI application logs with Elasticsearch, OpenSearch, and GemFire audit logs to detect unauthorized index or region access.
Monitoring Recommendations
- Enable slow query and audit logging on Elasticsearch, OpenSearch, and GemFire VectorDB clusters backing Spring AI deployments.
- Track the version of spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store artifacts across build pipelines.
- Alert on outbound query volume spikes from Spring AI service accounts to vector backends.
How to Mitigate CVE-2026-47835
Immediate Actions Required
- Upgrade Spring AI to version 1.0.9 for 1.0.x deployments or 1.1.8 for 1.1.x deployments.
- Audit application endpoints that forward user input into vector store similarity search or filter calls.
- Restrict network access to Elasticsearch, OpenSearch, and GemFire VectorDB instances so only the application tier can reach them.
Patch Information
VMware released fixed versions in Spring AI 1.0.9 and 1.1.8. The patched releases neutralize special characters before constructing backend queries in the spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store modules. Patch details are available in the Spring Security Advisory for CVE-2026-47835.
Workarounds
- Apply strict allow-list input validation at the application layer before passing values to Spring AI vector store APIs.
- Reject or escape DSL metacharacters in user-supplied search terms and metadata filter values.
- Run vector store backends with least-privilege service accounts limited to specific indices or regions used by the application.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
