PT-2026-39225 · Vmware · Spring Ai

Sharlongwen · Published 2026-05-08 · Updated 2026-05-12 · CVE-2026-41705

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.6 Spring AI versions 1.1.0 through 1.1.5

Description The doDelete(List) function in the MilvusVectorStore implementation is susceptible to filter-expression injection. This occurs because document IDs are not properly sanitized, which could allow an attacker to destroy data.

Recommendations Upgrade Spring AI versions 1.0.0 through 1.0.6 to 1.0.7 or greater. Upgrade Spring AI versions 1.1.0 through 1.1.5 to 1.1.6 or greater.

Fix

Weakness Enumeration

CWE-917

Related Identifiers

BDU:2026-07654

CVE-2026-41705

GHSA-V632-2M87-7469

Affected Products

Spring Ai

References · 12

• https://bdu.fstec.ru/vul/2026-07654 · Security Note
• https://spring.io/security/cve-2026-41705 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v632-2m87-7469 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41705 · Security Note
• https://github.com/spring-projects/spring-ai · Note
• https://github.com/spring-projects/spring-ai/pull/6011 · Note
• https://twitter.com/VigneshVic23698/status/2054071829514625434 · Twitter Post
• https://t.me/cveNotify/162836 · Telegram Post
• https://twitter.com/CVEarity/status/2053325447673602398 · Twitter Post
• https://twitter.com/SelvaKtm2/status/2053145951494443231 · Twitter Post
• https://t.me/CVEtracker/53189 · Telegram Post
• https://twitter.com/cybrsecpath/status/2053428329416704194 · Twitter Post