CVE-2026-41712: VMware Spring AI data exposure in chat memory component

CVE-2026-41712 · Severity: high · CVSS 7.5 · Published 2026-05-12

Spring AI, a framework for building AI-powered applications, contained a flaw in how it managed chat history between different users. Due to a shared default identifier, chat data from one user could be inadvertently exposed to another user if the developer did not manually specify unique IDs. This could lead to the leakage of sensitive personal or corporate information contained within AI chat sessions.

Technologies: VMware Spring Ai. Vendors: Broadcom, Maven, VMware.

Quick answers

Is CVE-2026-41712 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41712 being exploited in the wild.
How severe is CVE-2026-41712?
High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?
org.springframework.ai:spring-ai-advisors-vector-store (Maven) ECOSYSTEM:introduced=0,fixed=1.0.7; org.springframework.ai:spring-ai-client-chat (Maven) ECOSYSTEM:introduced=0,fixed=1.0.7; org.springframework.ai:spring-ai-model (Maven) ECOSYSTEM:introduced=0,fixed=1.0.7; VMware Spring Ai All versions prior to fix.
Is there a fix for CVE-2026-41712?
Yes. org.springframework.ai:spring-ai-advisors-vector-store (Maven): upgrade to 1.0.7 or later; org.springframework.ai:spring-ai-client-chat (Maven): upgrade to 1.0.7 or later; org.springframework.ai:spring-ai-model (Maven): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41712 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41712?
Check whether you run Broadcom Spring AI Advisors Vector Store, Broadcom Spring AI Client Chat, Broadcom Spring AI Model or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.ai:spring-ai-advisors-vector-store (Maven): upgrade to 1.0.7 or later
    # set org.springframework.ai:spring-ai-advisors-vector-store to 1.0.7 in your pom.xml or build.gradle
  • org.springframework.ai:spring-ai-client-chat (Maven): upgrade to 1.0.7 or later
    # set org.springframework.ai:spring-ai-client-chat to 1.0.7 in your pom.xml or build.gradle
  • org.springframework.ai:spring-ai-model (Maven): upgrade to 1.0.7 or later
    # set org.springframework.ai:spring-ai-model to 1.0.7 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Spring AI's ChatMemory component due to the use of a static 'DEFAULT_CONVERSATION_ID'. When developers use advisors such as MessageChatMemoryAdvisor, PromptChatMemoryAdvisor, or VectorStoreChatMemoryAdvisor without explicitly providing a unique conversation ID for each user session, the framework defaults to a shared ID. This results in 'Incorrect Default Permissions' (CWE-276), allowing different users to potentially access each other's chat history stored in the memory or vector store. The fix involves removing the default ID and requiring an explicit ID to be supplied via the advisor context; failure to provide one now results in an IllegalArgumentException. Patches are available in versions 1.0.7, 1.1.6, and 2.0.0-M6.

Affected products

  • Spring spring-ai-advisors-vector-store < 1.0.7, >= 1.1.0-M1 < 1.1.6, >= 2.0.0-M1 < 2.0.0-M6
  • Spring spring-ai-client-chat < 1.0.7, >= 1.1.0-M1 < 1.1.6, >= 2.0.0-M1 < 2.0.0-M6
  • Spring spring-ai-model < 1.0.7, >= 1.1.0-M1 < 1.1.6, >= 2.0.0-M1 < 2.0.0-M6

Identifiers

  • CVE-2026-41712
  • GHSA-q62f-h9x2-gcqc

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory
  • 2026-05-12: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.