CVE-2026-22729: 
Java vulnerability analysis and mitigation

CVE-2026-22729 is a JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter that allows attackers to bypass metadata-based access controls through crafted filter expressions. It affects VMware Spring AI versions 1.0.0–1.0.x (fixed in 1.0.4) and 1.1.0–1.1.x (fixed in 1.1.3). The vulnerability was disclosed on March 17, 2026, and was responsibly reported by the Blackf0g team from SecureLayer7. It carries a CVSS v3.1 base score of 8.6 (High) (Spring Advisory).

The root cause is improper neutralization of special elements used in an expression language statement (CWE-917): user-controlled input passed to FilterExpressionBuilder is directly concatenated into JSONPath queries without escaping. Special characters such as ", ||, and && are passed through unescaped, enabling attackers to inject arbitrary JSONPath logic that alters the intended query semantics. This affects any application using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or metadata-based document filtering. A detailed technical write-up was published by SecureLayer7, who discovered the issue (SecureLayer7 Blog, Spring Advisory).

Successful exploitation allows authenticated attackers to bypass metadata-based access controls and extract documents they are not authorized to access, resulting in a high confidentiality impact with no integrity or availability impact. In multi-tenant environments, this could enable cross-tenant data leakage, undermining role-based access control and document isolation guarantees. The changed scope in the CVSS vector reflects that the impact extends beyond the vulnerable component itself to other tenants or access-controlled document sets (Spring Advisory, SecureLayer7 Blog).

1. Identify target: Locate a Spring AI application (versions 1.0.0–1.0.3 or 1.1.0–1.1.2) that uses vector stores with AbstractFilterExpressionConverter for metadata-based filtering (e.g., PgVectorStore with multi-tenant document isolation).
2. Authenticate: Obtain valid credentials for the application, as the vulnerability requires an authenticated session.
3. Craft malicious filter expression: Construct a filter expression containing unescaped special characters such as ", ||, or && to inject additional JSONPath logic. For example, a value like value" || "1"=="1 could be injected into a metadata filter field.
4. Submit crafted request: Pass the malicious filter expression through the application's API or query interface that invokes FilterExpressionBuilder, which concatenates the input into a JSONPath query without sanitization.
5. Extract unauthorized documents: The injected JSONPath logic alters the query semantics, causing the vector store to return documents outside the attacker's authorized scope — potentially including documents belonging to other tenants or restricted roles (Spring Advisory, SecureLayer7 Blog).

• Logs: Application logs showing filter expression queries containing unusual special characters such as ", ||, or && in metadata filter parameters; unexpected query results returning documents from multiple tenants or roles in a single request.
• Network: Anomalous API requests to vector store query endpoints with filter parameters containing JSONPath operators or boolean logic constructs not typical of normal application usage.
• Application Behavior: Users or sessions accessing documents outside their expected tenant or role scope; sudden spikes in document retrieval volume from a single authenticated user.

VMware has released patched versions of Spring AI: upgrade to 1.0.4 (for 1.0.x users) or 1.1.3 (for 1.1.x users). The Spring advisory states no further mitigation steps are necessary beyond upgrading. As an interim measure prior to patching, organizations should restrict access to vector store query endpoints to trusted, authenticated users only and monitor for suspicious filter expression patterns (Spring Advisory).

The vulnerability was discovered and responsibly disclosed by the Blackf0g team at SecureLayer7, who published a detailed technical blog post (SecureLayer7 Blog). Security news outlets including SecurityOnline and The Hacker Wire covered the disclosure alongside the related SQL injection CVE-2026-22730 (SecurityOnline, The Hacker Wire). Community discussion on Reddit's r/java and r/netsec highlighted concerns about the Spring Boot 3.5 EOL timeline intersecting with the need to patch Spring AI, with developers noting urgency for teams running older versions (HeroDevs Blog). Canada's Cyber Centre (CCCS) also issued a security advisory (AV26-245) covering this vulnerability.