CVE-2026-41712

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1	US Government Resource
https://spring.io/security/cve-2026-41712	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:spring_ai::::::::
	cpe:2.3:a:vmware:spring_ai::::::::

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) El componente de memoria de chat de Spring AI contenía una configuración predeterminada problemática que, al no ser anulada explícitamente, podría resultar en una exposición de datos no intencionada entre usuarios.

Information

Published : 2026-05-12 11:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-41712

Mitre link : CVE-2026-41712

CVE.ORG link : CVE-2026-41712

JSON object : View

Products Affected

vmware

spring_ai

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2026-41712", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41712", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-12T12:13:06.957308Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@vmware.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@vmware.com", "affectedData": [{"vendor": "VMware", "product": "Spring AI", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.0.7", "versionType": "semver"}, {"status": "affected", "version": "1.1.0", "lessThan": "1.1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-12T11:16:19.403", "references": [{"url": "https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1", "tags": ["US Government Resource"], "source": "security@vmware.com"}, {"url": "https://spring.io/security/cve-2026-41712", "tags": ["Vendor Advisory"], "source": "security@vmware.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users."}, {"lang": "es", "value": "El componente de memoria de chat de Spring AI conten\u00eda una configuraci\u00f3n predeterminada problem\u00e1tica que, al no ser anulada expl\u00edcitamente, podr\u00eda resultar en una exposici\u00f3n de datos no intencionada entre usuarios."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3EED561-3D9D-48C8-8AB7-AF0A94F87D31", "versionEndExcluding": "1.0.7", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EFDEFC4-3E15-4C9F-9DEF-0350C37D51FE", "versionEndExcluding": "1.1.6", "versionStartIncluding": "1.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@vmware.com"}