Loading vulnerability…
VectorStore FilterExpression Converter Injection in Spring AI
CVE-2026-40967 is an injection vulnerability in Spring AI affecting multiple FilterExpressionConverter implementations used by VectorStore components. These converters accept a filter expression object and translate it into backend-specific vector store query languages. In affected versions, keys and values are not properly escaped in several cases, allowing crafted input to alter the resulting query semantics. The issue affects Spring AI 1.0.0 through 1.0.5 and 1.1.0 through 1.1.4. It is fixed in versions 1.0.6 and 1.1.5.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to manipulate vector store queries generated by the application. Depending on how the application uses filter expressions and what data is exposed through the underlying vector store, this can result in unauthorized access to data, bypass of intended filtering or access constraints, modification of query logic, and limited integrity or availability impact through malformed or broadened queries.
If you can’t patch tonight, do this now.
Avoid passing untrusted or directly user-supplied input into filterExpression objects used by Spring AI VectorStore implementations until patched versions are deployed. Where possible, constrain filter construction to a strict server-side allowlist of expected fields and values, validate and canonicalize input before query generation, and reduce exposure of VectorStore-backed query functionality to untrusted users.
Patch, then assume compromise.
Upgrade Spring AI to a fixed release. For the 1.0.x branch, upgrade to 1.0.6 or later. For the 1.1.x branch, upgrade to 1.1.5 or later. Ensure all deployed applications using VectorStore functionality are rebuilt and redeployed with the patched dependency versions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.