CVE-2026-40966

5.9 Moyenne

Publiée le 28/04/2026 à 10:16 · Modifiée le 17/06/2026 à 12:45 · Analysée par le NVD · Source : security@vmware.com

Description

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.

Traduire en français

Produits concernés

VMware Spring AI

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.9 Moyenne	security@vmware.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-284

Références

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N US Government Resource
https://spring.io/security/cve-2026-40966 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories