CVE-2026-22743: 
Java vulnerability analysis and mitigation

CVE-2026-22743 is a Cypher injection vulnerability in Spring AI's spring-ai-neo4j-store component, specifically within the Neo4jVectorFilterExpressionConverter class. When a user-controlled string is passed as a filter expression key, the doKey() function embeds it into a backtick-delimited Cypher property accessor without properly escaping embedded backticks, enabling injection of arbitrary Cypher commands. Affected versions include Spring AI 1.0.0 through 1.0.x (before 1.0.5) and 1.1.0 through 1.1.x (before 1.1.4). The vulnerability was disclosed on March 26–27, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (Spring Advisory, Feedly).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL/Query Command — analogous injection in Cypher query language). The doKey() method in Neo4jVectorFilterExpressionConverter constructs Cypher property accessors of the form node.`metadata.<key>` by stripping only double-quote characters from user input, but fails to escape or sanitize embedded backtick characters. An attacker who controls the filter expression key can break out of the backtick-delimited context and inject arbitrary Cypher clauses into the resulting query. No authentication, user interaction, or special privileges are required — the attack is exploitable remotely over the network with low complexity (Spring Advisory, Feedly).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary Cypher commands against the backend Neo4j database, resulting in unauthorized read access to data stored in the Neo4j vector store. The primary impact is a high confidentiality loss — attackers can query and exfiltrate sensitive metadata, embeddings, and other information stored in the database. Integrity and availability are not directly impacted according to the CVSS assessment, but depending on Neo4j permissions, injected queries could potentially be used for further lateral movement within the data tier (Spring Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041% (0.00041), indicating a low current probability of exploitation in the wild. Detection signatures are available via Nessus (plugin 304267) and Qualys (QID 5009971) (Feedly).

1. Reconnaissance: Identify applications using Spring AI's spring-ai-neo4j-store module in versions 1.0.0–1.0.4 or 1.1.0–1.1.3, which expose endpoints that accept user-controlled filter expression keys for Neo4j vector similarity searches.
2. Craft malicious filter key: Construct a filter expression key containing an embedded backtick character (`) to break out of the backtick-delimited Cypher property accessor context. For example, a key like foo` RETURN n UNION MATCH (m) RETURN m // would terminate the intended property accessor and inject additional Cypher clauses.
3. Submit the payload: Pass the crafted key as a filter expression parameter to the vulnerable API endpoint that invokes Neo4jVectorFilterExpressionConverter.doKey(), triggering construction of a malformed Cypher query such as MATCH (n) WHERE n.`metadata.foo` RETURN n UNION MATCH (m) RETURN m // .
4. Extract data: The injected Cypher query executes against the Neo4j database, returning unauthorized data — including node properties, metadata, and stored embeddings — in the API response.
5. Iterate: Repeat with varied payloads to enumerate database structure and extract additional sensitive information (Spring Advisory, Feedly).

• Network: Unusual or malformed API requests to Spring AI vector search endpoints containing backtick characters (`) or Cypher keywords (e.g., UNION, MATCH, RETURN, WHERE) in filter expression key parameters.
• Logs: Neo4j query logs showing unexpected Cypher syntax, UNION clauses, or queries returning data from unintended node labels; Spring application logs showing query construction errors or unexpected result sets from Neo4j.
• Application Behavior: API responses returning unexpectedly large datasets, data from unrelated node types, or structured data inconsistent with the intended vector store query scope.

Users should immediately upgrade Spring AI to the patched versions: 1.0.5 (for the 1.0.x branch) or 1.1.4 (for the 1.1.x branch), both available as OSS releases. The Spring advisory states no additional mitigation steps are necessary beyond upgrading. As supplementary hardening measures, organizations should implement input validation and sanitization for all user-controlled filter expression keys, consider Neo4j query parameterization where feasible, and monitor Neo4j query logs for anomalous Cypher patterns (Spring Advisory).

The Canadian Centre for Cyber Security (CCCS) issued a security advisory (AV26-288) covering this vulnerability shortly after disclosure (CCCS Advisory). Spain's INCIBE-CERT also published an alert. The vulnerability was identified by Cantina's AppSec agent, Apex, and credited in the official Spring advisory (Spring Advisory). Social media activity was limited, with mentions on Mastodon and Bluesky from CVE tracking accounts, reflecting moderate community awareness without significant controversy or debate.