VulnerabilityPublished 18 Mar 2026

CVE-2026-22729: VMware Spring AI · Expression Language Injection

Affects VMware Spring AISource CVE Database V5

Compare

Not known to be exploited · CVSS 8.6 High : upgrade to 1.1.3 or 1.0.4 soon.

Data as of 31 Oct 2026, 20:20 UTC

CVSS 3.1 base score

8.6High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.5% chance of exploitation in 30 days – higher than 45% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 1.1.3, 1.0.4

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Changed
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 31 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade VMware Spring AI to 1.1.3 or 1.0.4.

Affected software

Product	Affected	Fixed in
VMwareSpring AI	Affected >=1.1.x <1.1.3	Fixed in 1.1.3
VMwareSpring AI	Affected >=1.0.x <1.0.4	Fixed in 1.0.4

AI-suggested

To mitigate CVE-2026-22729, organizations should immediately upgrade to patched versions of VMware Spring AI once available. In the absence of patches, developers should implement strict input validation and sanitization for all user-supplied filter expressions, ensuring that special characters such as ",", "||", and "&&" are properly escaped or disallowed. Employing a whitelist approach for allowed JSONPath syntax or using parameterized query mechanisms can prevent injection. Additionally, enforcing strong authentication and monitoring access logs for anomalous filter expression patterns can help detect exploitation attempts. Segmentation and least privilege principles should be applied to limit the impact of any potential breach. Finally, conducting security code reviews and penetration testing focused on JSONPath query construction can identify similar injection risks proactively.

Description

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents. This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata. The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.

Impact

The primary impact of CVE-2026-22729 is unauthorized disclosure of sensitive documents due to bypassed metadata-based access controls. Organizations relying on Spring AI's AbstractFilterExpressionConverter for multi-tenant isolation or role-based filtering may have their data segregation controls circumvented, leading to potential data leaks across tenants or roles. This can result in exposure of confidential business information, personally identifiable information (PII), or intellectual property. Since the vulnerability does not affect data integrity or availability, the main concern is confidentiality compromise. The ease of exploitation (no privileges or user interaction required) and network accessibility increase the risk of widespread exploitation once an exploit is developed. This threat is especially critical for organizations using Spring AI in regulated industries or handling sensitive data, as unauthorized access could lead to compliance violations, reputational damage, and financial loss.

CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection) (opens in a new tab)
Base weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Architecture and Design
Avoid adding user-controlled data into an expression interpreter when possible.
Implementation
If user-controlled data must be added to an expression interpreter, one or more of the following should be performed: Validate that the user input will not evaluate as an expression; Encode the user input in a way that ensures it is not evaluated as an expression
System Configuration · Operation
The framework or tooling might allow the developer to disable or deactivate the processing of EL expressions, such as setting the isELIgnored attribute for a JSP page to "true".
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Deserialization (opens in a new tab)
Injection Prevention (opens in a new tab)
SQL Injection Prevention (opens in a new tab)
Injection Prevention in Java (opens in a new tab)
OWASP ASVS 4.0.3
V1.5.1 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

spring.io/security/cve-2026-22729 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 18 Mar 2026, 08:12 UTC

WeaknessesCWE-917

Technical details

References

Community reviews

Related threats