CVE-2026-47835
Description
Spring AI Vector Stores fail to sanitize special characters in metadata filtering, enabling arbitrary query execution in Elasticsearch, OpenSearch, and GemFire VectorDB.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Spring AI Vector Stores fail to sanitize special characters in metadata filtering, enabling arbitrary query execution in Elasticsearch, OpenSearch, and GemFire VectorDB.
Vulnerability
Spring AI Vector Stores in versions 1.0.0 through 1.0.x and 1.1.0 through 1.1.x do not properly sanitize special characters in metadata filtering. This flaw affects the spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfire-store components, allowing an attacker to inject arbitrary query syntax into the underlying vector database queries [1].
Exploitation
An attacker with network access to the vector store endpoint can craft a malicious metadata filter containing special characters (e.g., quotes, operators) that bypasses intended filtering logic. No authentication or user interaction is required, as the vulnerability is triggered purely by sending a crafted request to the affected service [1].
Impact
Successful exploitation leads to unauthorized execution of arbitrary queries against the Elasticsearch, OpenSearch, or GemFire VectorDB backends. This can result in high confidentiality impact (reading sensitive vector data) and limited integrity/availability impact (modifying or deleting data). The CVSS v3.1 score is 8.6 (High) [1].
Mitigation
Users should upgrade to the fixed versions: Spring AI 1.0.9 for the 1.0.x line and Spring AI 1.1.8 for the 1.1.x line. No other mitigation steps are necessary, and no workarounds are provided [1].
AI Insight generated on Jun 15, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
3- Range: >=1.0.0, <1.0.9 || >=1.1.0, <1.1.8
- Range: >=1.0.0, <1.0.9 || >=1.1.0, <1.1.8
- Range: >=1.0.0, <1.0.9 || >=1.1.0, <1.1.8
Patches
0No patches discovered yet.
Vulnerability mechanics
No source-code context for this CVE — mechanics is only generated when we can read the actual fix diff. Without that, the four sections (root cause, attack vector, affected code, fix) would be speculation rather than analysis.
References
1News mentions
0No linked articles in our index yet.