PT-2026-35687

CVE-2026-40978

Published

2026-04-28

Updated

2026-04-28

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Spring AI versions 1.0.0 through 1.0.5 Spring AI versions 1.1.0 through 1.1.4

Description An issue in CosmosDBVectorStore allows attackers to execute arbitrary SQL queries by using crafted document IDs.

Recommendations Update versions 1.0.0 through 1.0.5 to version 1.0.6. Update versions 1.1.0 through 1.1.4 to version 1.1.5.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

Related identifiers

GHSA-63C8-M9M2-CVR3

Found an issue in the description? Have something to add? Feel free to write us 👾