CyberRota Analysis
This is a medium severity vulnerability with a CVSS score of 5.9. See the original NVD description below for full technical details.
CVE
CVE-2026-40966
Severity
MEDIUM
CVSS
5.9
EPSS
0.23%
Original NVD Description
In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected.
Related CVEs
Other vulnerabilities affecting the same vendor(s)