Skip to content
OpenAdvisories
High · 7.5 CVE-2026-41712 EUVD-2026-29448GHSA-q62f-h9x2-gcqc

ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage

Published May 12, 2026 · Updated May 12, 2026 · Assigned by vmware

Vendor: VMware Product: Spring AI Package: org.springframework.ai:spring-ai-advisors-vector-store Package: org.springframework.ai:spring-ai-client-chat Package: org.springframework.ai:spring-ai-model Ecosystem: Maven

Description

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

Affected products

VendorProductAffectedFixed
VMware Spring AI 1.0.0 – < 1.0.7, 1.1.0 – < 1.1.6 1.0.7

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.springframework.ai:spring-ai-advisors-vector-store < 1.0.7 1.0.7 GHSA-q62f-h9x2-gcqc
Maven org.springframework.ai:spring-ai-advisors-vector-store >= 1.1.0-M1, < 1.1.6 1.1.6 GHSA-q62f-h9x2-gcqc
Maven org.springframework.ai:spring-ai-advisors-vector-store >= 2.0.0-M1, < 2.0.0-M6 2.0.0-M6 GHSA-q62f-h9x2-gcqc
Maven org.springframework.ai:spring-ai-client-chat < 1.0.7 1.0.7 GHSA-q62f-h9x2-gcqc
Maven org.springframework.ai:spring-ai-client-chat >= 1.1.0-M1, < 1.1.6 1.1.6 GHSA-q62f-h9x2-gcqc
Maven org.springframework.ai:spring-ai-client-chat >= 2.0.0-M1, < 2.0.0-M6 2.0.0-M6 GHSA-q62f-h9x2-gcqc
Maven org.springframework.ai:spring-ai-model < 1.0.7 1.0.7 GHSA-q62f-h9x2-gcqc
Maven org.springframework.ai:spring-ai-model >= 1.1.0-M1, < 1.1.6 1.1.6 GHSA-q62f-h9x2-gcqc
Maven org.springframework.ai:spring-ai-model >= 2.0.0-M1, < 2.0.0-M6 2.0.0-M6 GHSA-q62f-h9x2-gcqc

References