CVE-2026-59308 Overview
CVE-2026-59308 affects Spring AI's Semantic Cache support. The context hash used to isolate cached responses between different system prompts can allow cached responses to be shared across unrelated contexts. An attacker with low privileges on the network can trigger conditions where responses cached for one system prompt are returned in the context of another, resulting in limited confidentiality and integrity impact. The issue is categorized under [CWE-668: Exposure of Resource to Wrong Sphere]. Spring AI version 2.0.0 is listed as affected in the Spring Security Advisory CVE-2026-59308.
Critical Impact
Cached AI responses may leak between unrelated system prompt contexts, breaking tenant or session isolation for applications relying on Spring AI Semantic Cache.
Affected Products
- Spring AI 2.0.0
- Applications using Spring AI Semantic Cache support
- Multi-tenant AI services built on Spring AI with distinct system prompts
Discovery Timeline
- 2026-08-21 - CVE-2026-59308 published to the National Vulnerability Database (NVD)
- 2026-08-21 - Last updated in NVD database
Technical Details for CVE-2026-59308
Vulnerability Analysis
Spring AI provides a Semantic Cache feature that stores model responses keyed by semantic similarity of prompts. To keep cached content separated between different application contexts, the implementation derives a context hash tied to the system prompt configured for a given interaction. This hash is intended to ensure that a cached response produced under one system prompt cannot be returned to a caller operating under a different system prompt.
The hash generation logic does not sufficiently discriminate between distinct system prompt contexts. As a result, semantically similar user prompts issued under different system prompts can collide on the same cache key. A caller then receives a response that was generated for another context, violating the isolation guarantee the cache was meant to provide.
The advisory classifies the issue as [CWE-668], exposure of a resource to the wrong sphere. The impact is bounded to confidentiality and integrity of cached content and does not directly enable code execution or availability loss.
Root Cause
The root cause is an insufficiently strong context hash for cache key isolation. The hash treats distinct system prompts as equivalent under certain inputs, allowing responses cached for one context to be served to another.
Attack Vector
Exploitation requires network access and authenticated, low-privileged use of an application backed by Spring AI Semantic Cache. Attack complexity is high because the attacker must induce cache collisions across contexts they do not control. No user interaction is required. Refer to the Spring Security Advisory CVE-2026-59308 for vendor-provided technical detail.
No verified proof-of-concept code is available; the vulnerability is described in prose here rather than with synthetic exploit code.
Detection Methods for CVE-2026-59308
Indicators of Compromise
- Cached AI responses returned to users whose system prompt configuration differs from the prompt that originally produced the response
- Unexpected content appearing in responses for tenants, sessions, or roles that should be isolated
- Cache hit metrics that spike across previously unrelated system prompt contexts
Detection Strategies
- Inventory applications that depend on Spring AI 2.0.0 and enable Semantic Cache, then compare configurations against the Spring Security Advisory CVE-2026-59308
- Log the system prompt identifier alongside cache keys and returned responses to detect cross-context reuse
- Add integration tests that issue semantically similar prompts under distinct system prompts and verify responses do not collide
Monitoring Recommendations
- Emit metrics for cache hits grouped by system prompt hash and alert on hits attributed to more than one context
- Forward Spring AI application logs and cache telemetry into a centralized data lake for correlation across tenants
- Track dependency versions in build pipelines and flag any deployment pinned to Spring AI 2.0.0
How to Mitigate CVE-2026-59308
Immediate Actions Required
- Identify services running Spring AI 2.0.0 with Semantic Cache enabled and prioritize them for update
- Disable Semantic Cache in affected services until a fixed version is deployed if strict prompt isolation is required
- Purge existing cache entries so responses generated under the vulnerable hash logic are not served after remediation
Patch Information
Consult the Spring Security Advisory CVE-2026-59308 for the fixed version and upgrade guidance. Upgrade Spring AI to the patched release identified in the advisory and redeploy affected applications.
Workarounds
- Temporarily disable Spring AI Semantic Cache until patched builds are rolled out
- Partition caches per tenant or per system prompt at the application layer so isolation does not depend on the vulnerable context hash
- Restrict the set of system prompts allowed per authenticated principal to reduce cross-context collision opportunities
# Configuration example
# Disable Spring AI Semantic Cache in application.properties until patched
spring.ai.cache.semantic.enabled=false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
