CVE-2026-47852: Spring AI Privilege Escalation Vulnerability

CVE-2026-47852 Overview

CVE-2026-47852 affects Spring AI's ONNX model cache handling. A local attacker on a multi-user host can pre-create the deterministic cache path used by Spring AI and plant a malicious ONNX model file. When a legitimate Spring AI process loads the model, it consumes the attacker-controlled file instead of the expected artifact. The flaw permits integrity compromise of AI model workflows on shared systems.

Critical Impact
Local attackers can substitute trusted ONNX models with malicious files, tampering with model integrity and downstream inference results on multi-user hosts.

Affected Products

Spring AI 2.0.0
Spring AI 1.1.0 through 1.1.8
Spring AI 1.0.0 through 1.0.9

Discovery Timeline

2026-08-27 - CVE-2026-47852 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47852

Vulnerability Analysis

Spring AI caches ONNX models on disk using a deterministic path derived from model metadata. On a multi-user host, that path is predictable and reachable by any local user with write access to the cache directory. An unprivileged attacker can create the target file before Spring AI populates the cache. When the framework subsequently attempts to load the cached model, it reads the attacker's ONNX file rather than downloading or validating the intended artifact.

Because the cache path is deterministic and the framework does not verify file ownership, provenance, or a content hash prior to use, integrity of the loaded model cannot be assured. The result is silent substitution of AI model data used by downstream inference or embedding operations.

Root Cause

The root cause is insecure use of a predictable filesystem location combined with missing integrity validation. This aligns with file system permission and path predictability weaknesses, and shares properties with time-of-check to time-of-use (TOCTOU) issues on shared hosts. The framework trusts pre-existing cache contents without cryptographic verification against a known-good model digest.

Attack Vector

Exploitation requires local write access to the Spring AI cache directory on a shared host. The attacker enumerates or predicts the deterministic ONNX cache path, writes a malicious ONNX file at that path, and waits for a Spring AI process running under another user to load the model. No user interaction from the victim service is required beyond normal model loading. See the Spring Security advisory for CVE-2026-47852 for vendor-provided technical details.

Detection Methods for CVE-2026-47852

Indicators of Compromise

Unexpected ONNX files in the Spring AI cache directory created by user accounts other than the Spring AI service account.
ONNX model files whose hash does not match the vendor-published digest for the referenced model version.
Filesystem creation events for Spring AI cache paths preceding the first legitimate model download.

Detection Strategies

Compute and compare SHA-256 hashes of cached ONNX files against known-good digests published by the model provider.
Audit file ownership and creation timestamps on Spring AI cache directories to identify files not written by the service account.
Alert on local users writing to directories consumed by Spring AI processes running under different UIDs.

Monitoring Recommendations

Enable Linux audit rules (auditd) on Spring AI cache paths to log write and create operations.
Forward filesystem telemetry to a SIEM and correlate cache writes with subsequent Spring AI process reads.
Track Spring AI application logs for model load events and cross-reference with cache file mtimes.

How to Mitigate CVE-2026-47852

Immediate Actions Required

Upgrade Spring AI to a fixed release as identified in the Spring Security advisory for CVE-2026-47852.
Restrict the Spring AI cache directory to the service account only, removing world- and group-writable permissions.
Deploy Spring AI workloads in dedicated user contexts or containers rather than on shared multi-user hosts.

Patch Information

Refer to the Spring Security advisory for CVE-2026-47852 for the fixed versions covering Spring AI 1.0.x, 1.1.x, and 2.0.x branches. Apply the vendor-supplied update and rebuild the cache from a clean state after upgrading.

Workarounds

Relocate the Spring AI cache to a directory owned exclusively by the service account with mode 0700.
Pre-populate the cache from a trusted build pipeline and mount it read-only at runtime.
Isolate Spring AI processes in per-user containers so cache paths cannot be observed or written by other tenants.

bash

# Configuration example: restrict Spring AI cache directory permissions
sudo chown -R springai:springai /var/cache/spring-ai
sudo chmod 700 /var/cache/spring-ai
sudo find /var/cache/spring-ai -type f -exec chmod 600 {} \;