CVE-2026-22738: 
Java vulnerability analysis and mitigation

CVE-2026-22738 is a critical SpEL (Spring Expression Language) injection vulnerability in Spring AI's SimpleVectorStore component that allows unauthenticated remote attackers to execute arbitrary code. It affects Spring AI versions 1.0.0 through 1.0.x (fixed in 1.0.5) and 1.1.0 through 1.1.x (fixed in 1.1.4). The vulnerability was disclosed on March 26–27, 2026, and was reported responsibly by Hyunwoo Kim (@V4bel) via Cantina's AppSec agent, Apex. It carries a CVSS v3.1 base score of 9.8 (Critical) (Spring Advisory, Feedly).

The root cause is improper neutralization of special elements in an Expression Language statement (CWE-917) combined with argument injection (CWE-88). When an application uses SimpleVectorStore and passes user-supplied input directly as a filter expression key, the value is evaluated as a SpEL expression without sanitization or escaping, enabling arbitrary code execution. The attack vector is network-accessible, requires no authentication, no privileges, and no user interaction — making it exploitable by any remote actor who can reach the similaritySearch endpoint of a vulnerable Spring AI deployment. A public Python PoC (exploit.py) is available on GitHub that demonstrates unauthenticated RCE by injecting SpEL payloads into this endpoint (Spring Advisory, PoC GitHub).

Successful exploitation grants an unauthenticated remote attacker full code execution on the application server, with confidentiality, integrity, and availability all rated HIGH. An attacker can read sensitive data, modify application state, drop web shells, establish persistence, or pivot to other internal systems accessible from the compromised server. Only applications that use SimpleVectorStore and pass user-controlled values as filter expression keys are affected; applications using other vector store implementations are not impacted (Spring Advisory, Resecurity).

A functional Python PoC exploit (exploit.py) is publicly available on GitHub, capable of performing unauthenticated RCE against vulnerable Spring AI deployments by injecting SpEL expressions into the similaritySearch endpoint; the repository also includes a Docker Compose environment for testing (PoC GitHub). A second PoC repository has also appeared on GitHub (rockmelodies PoC). As of the latest intelligence, there is no confirmed evidence of in-the-wild exploitation by threat actors, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.071% (low probability of exploitation in the near term), though the availability of working PoC code elevates practical risk. The vulnerability is detectable by Nessus (plugin 304267) and Qualys (QID 5009975) (Feedly).

1. Reconnaissance: Identify internet-facing Spring AI applications using SimpleVectorStore via Shodan, Censys, or application fingerprinting. Target endpoints that accept user-supplied filter parameters for vector similarity search.
2. Confirm vulnerability: Send a benign test request to the similaritySearch endpoint with a crafted filter expression key to observe whether SpEL evaluation occurs (e.g., a mathematical expression like #{1+1} that returns a predictable result).
3. Craft SpEL payload: Construct a malicious SpEL expression as the filter key, such as T(java.lang.Runtime).getRuntime().exec('id') or a payload that writes a file (e.g., touch /tmp/pwned_cve_2026_22738) to confirm code execution.
4. Inject payload: Submit the crafted HTTP request to the vulnerable endpoint with the SpEL expression embedded in the filter expression key parameter.
5. Exfiltrate output / establish persistence: Use the RCE primitive to exfiltrate command output via an out-of-band channel (e.g., DNS or HTTP callback), deploy a reverse shell, or drop a web shell for persistent access (PoC GitHub, Resecurity).

• Network: Unusual HTTP requests to similaritySearch or vector store endpoints containing SpEL expression syntax (e.g., T(java.lang.Runtime), #{, @, or class references like java.lang.ProcessBuilder); unexpected outbound connections from the application server to unknown external IPs or DNS lookups to attacker-controlled domains.
• Logs: Application logs showing SpEL evaluation errors or stack traces originating from SimpleVectorStore filter processing; access logs with anomalous or encoded filter key parameters in requests to vector search endpoints.
• File System: Unexpected files created in world-writable directories (e.g., /tmp/pwned_cve_2026_22738 as demonstrated in the PoC); new scripts, web shells, or binaries in the application deployment directory; modified cron jobs or startup scripts.
• Process: Unusual child processes spawned by the Java application process (e.g., /bin/sh, bash, curl, wget, python3, nc); unexpected network connections initiated by the JVM process (PoC GitHub, Resecurity).

Upgrade Spring AI to version 1.0.5 (for 1.0.x users) or 1.1.4 (for 1.1.x users); no additional mitigation steps are required after patching (Spring Advisory). If immediate patching is not possible, avoid passing any user-supplied input directly as filter expression keys in SimpleVectorStore operations, and implement strict allowlist-based input validation and sanitization on all filter parameters. Applications not using SimpleVectorStore or not passing user-controlled values as filter expression keys are not affected and do not require remediation.

The Spring team rated the vulnerability CRITICAL and published a security advisory on March 26, 2026, crediting the responsible disclosure by Hyunwoo Kim (@V4bel) via Cantina's AppSec agent (Spring Advisory). Resecurity published a detailed technical write-up tracing the exploitation path from vector search to RCE (Resecurity). The Hacker Wire covered the vulnerability shortly after disclosure, and the Canadian Centre for Cyber Security (CCCS) issued an advisory (AV26-288) (CCCS Advisory). The vulnerability was also featured in a TryHackMe room and multiple community writeups, indicating broad practitioner interest. HeroDevs noted it as part of a surge in Spring CVEs in 2026 (HeroDevs).