CVE-2026-41712high

CVE-2026-41712: high-severity vulnerability in VMware Spring AI

ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Published

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.4%
exploitation probability
0.4%top 66% of all CVEs
observed exploitation
nono source reports it
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
VMware · Spring AI
Related CVEs — VMware Spring AI

In the same product, most dangerous first.

CVE-2026-22729HIGHCVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverterEPSS 0.5%CVE-2026-22730HIGHCVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverterEPSS 0.5%CVE-2026-40966MEDIUMVectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltrationEPSS 0.4%CVE-2026-41713HIGHPrompt Injection via Memory Poisoning in PromptChatMemoryAdvisorEPSS 0.4%
References
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N&version=3.1https://spring.io/security/cve-2026-41712