High severity8.6NVD Advisory· Published Apr 28, 2026· Updated Apr 29, 2026

CVE-2026-40967

Description

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query.

Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.springframework.ai:spring-ai-vector-storeMaven	>= 1.0.0, < 1.0.6	1.0.6
org.springframework.ai:spring-ai-vector-storeMaven	>= 1.1.0, < 1.1.5	1.1.5

Affected products

VMware/Spring AI
cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*
Range: >=1.0.0,<1.0.6
ghsa-coords
pkg:maven/org.springframework.ai/spring-ai-vector-store
Range: >= 1.0.0, < 1.0.6

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-qc4j-qjqx-vr58ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-40967ghsaADVISORY
spring.io/security/cve-2026-40967nvdVendor AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000