org.springframework.ai:spring-ai-advisors-vector-store

2 results · Feed

• High 7.5
  CVE-2026-41712

  ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

  Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

  VMware Spring AI org.springframework.ai:spring-ai-client-chat org.springframework.ai:spring-ai-advisors-vector-store Maven
  May 12, 2026
• Medium 5.9
  CVE-2026-40966

  VectorStoreChatMemoryAdvisor conversation scoping can lead to cross-tenant memory exfiltration

  In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemory…

  VMware Spring AI org.springframework.ai:spring-ai-advisors-vector-store Maven
  Apr 28, 2026