Executive brief
Spring AI, a framework for building AI-powered applications, contained a flaw in how it managed chat history between different users. Due to a shared default identifier, chat data from one user could be inadvertently exposed to another user if the developer did not manually specify unique IDs. This could lead to the leakage of sensitive personal or corporate information contained within AI chat sessions.
Technical details
A vulnerability exists in Spring AI's ChatMemory component due to the use of a static 'DEFAULT_CONVERSATION_ID'. When developers use advisors such as MessageChatMemoryAdvisor, PromptChatMemoryAdvisor, or VectorStoreChatMemoryAdvisor without explicitly providing a unique conversation ID for each user session, the framework defaults to a shared ID. This results in 'Incorrect Default Permissions' (CWE-276), allowing different users to potentially access each other's chat history stored in the memory or vector store. The fix involves removing the default ID and requiring an explicit ID to be supplied via the advisor context; failure to provide one now results in an IllegalArgumentException. Patches are available in versions 1.0.7, 1.1.6, and 2.0.0-M6.
Affected products
- Spring spring-ai-advisors-vector-store < 1.0.7, >= 1.1.0-M1 < 1.1.6, >= 2.0.0-M1 < 2.0.0-M6
- Spring spring-ai-client-chat < 1.0.7, >= 1.1.0-M1 < 1.1.6, >= 2.0.0-M1 < 2.0.0-M6
- Spring spring-ai-model < 1.0.7, >= 1.1.0-M1 < 1.1.6, >= 2.0.0-M1 < 2.0.0-M6
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory
- 2026-05-12: patched