CVE-2026-40967

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40967", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "state": "PUBLISHED", "assignerShortName": "vmware", "dateReserved": "2026-04-16T02:18:56.133Z", "datePublished": "2026-04-28T06:03:51.857Z", "dateUpdated": "2026-04-29T13:29:47.165Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-04-28T07:06:12.153Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code", "type": "CWE"}]}], "affected": [{"vendor": "Spring", "product": "Spring AI", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.6", "versionType": "custom"}, {"status": "affected", "version": "1.1.0", "lessThan": "1.1.5", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.\n\nAffected versions:\nSpring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)", "supportingMedia": [{"type": "text/html", "base64": false, "value": "In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.<br><br>Affected versions:<br>Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)"}]}], "references": [{"url": "https://spring.io/security/cve-2026-40967"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-29T03:55:37.906349Z", "id": "CVE-2026-40967", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-29T13:29:47.165Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40967", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-29T03:55:37.906349Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T12:31:49.476Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Spring AI", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.6", "versionType": "custom"}, {"status": "affected", "version": "1.1.0", "lessThan": "1.1.5", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-40967"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.\n\nAffected versions:\nSpring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)", "supportingMedia": [{"type": "text/html", "value": "In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.<br><br>Affected versions:<br>Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-04-28T07:06:12.153Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40967", "state": "PUBLISHED", "dateUpdated": "2026-04-29T13:29:47.165Z", "dateReserved": "2026-04-16T02:18:56.133Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-04-28T06:03:51.857Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Spring AI", "vendor": "Spring", "versions": [{"lessThan": "1.0.6", "status": "affected", "version": "1.0.0", "versionType": "custom"}, {"lessThan": "1.1.5", "status": "affected", "version": "1.1.0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*", "matchCriteriaId": "1CD6DC44-CDE8-47E4-A788-6D8AE716396F", "versionEndExcluding": "1.0.6", "versionStartIncluding": "1.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*", "matchCriteriaId": "5013645B-3914-4A40-8D42-CB47344963A7", "versionEndExcluding": "1.1.5", "versionStartIncluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.\n\nAffected versions:\nSpring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)"}, {"lang": "es", "value": "En Spring AI, varias implementaciones de FilterExpressionConverter aceptan un objeto de expresi\u00f3n de filtro y los traducen a lenguajes de consulta espec\u00edficos de almacenes vectoriales. En varios casos, las claves y los valores no se escapan correctamente, lo que lleva a la capacidad de alterar la consulta.\n\nVersiones afectadas:\nSpring AI: 1.0.0 - 1.0.5 (corregido en 1.0.6), 1.1.0 - 1.1.4 (corregido en 1.1.5)"}], "id": "CVE-2026-40967", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security@vmware.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40967", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-29T03:55:37.906349Z", "version": "2.0.3"}}]}, "published": "2026-04-28T07:16:03.360", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2026-40967"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security@vmware.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.0.6)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.0,1.1.5)"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "Spring AI", "source": "cna", "vendor": "Spring"}, "product": "spring", "vendor": "spring"}], "analysis": {"en": {"generated_at": "2026-04-28T19:28:42.393313+00:00", "value": {"mitigation_remediation": ["Upgrade to Spring AI 1.0.6 or later, or 1.1.5 or later, to apply the patch that properly escapes keys and values.", "If upgrading is not immediately possible, restrict user\u2011supplied filter expressions to a safe, whitelisted set of allowed tokens or validate the syntax to prevent unescaped input.", "If the vulnerable feature is not needed, disable or remove the filter expression conversion functionality to eliminate the risk."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The affected products are Spring AI versions 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4. These ranges were fixed starting with Spring AI 1.0.6 and 1.1.5, respectively. Users running any of the affected releases are at risk.", "description_and_impact": "Spring AI\u2019s FilterExpressionConverter component processes filter expressions and converts them into query language syntax for vector stores. The implementations for several filters fail to escape keys and values properly. As a result, an attacker can inject arbitrary text into the generated query, allowing them to manipulate the query logic or execute unintended commands. This flaw is a code injection vulnerability that can compromise the integrity of the underlying query processing system and potentially enable attackers to gain unauthorized access to data or execute arbitrary code. The weakness is identified as CWE\u201194: Improper Handling of Code in Code Generation.", "risk_and_exploitability": "The CVSS score of 8.6 indicates a high severity vulnerability. No EPSS score is available, so the likelihood of exploitation cannot be quantified from the provided data, but the lack of a KEV designation suggests that it has not yet been widely exploited. The attack vector relies on providing a specially crafted filter expression that is processed by an application using the vulnerable Spring AI component. If the application exposes an interface for filter expressions, an attacker could supply malicious input to alter the query logic."}}}}, "created": "2026-04-28T08:15:23.494091+00:00", "title": "Unescaped Filter Expressions Enable Query Injection in Spring AI", "updated": "2026-04-28T19:30:27.392576+00:00", "vendors": ["spring", "spring$PRODUCT$spring"]}