Spring AI 1.0.0-1.0.5 / 1.1.0-1.1.4 Shared Env Exposes ONNX (fixed 1.0.6/1.1.5)
CVE-2026-40979 Published on April 28, 2026
In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)
Vulnerability Analysis
CVE-2026-40979 can be exploited with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and no impact on availability.
Weakness Type
Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.
Products Associated with CVE-2026-40979
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
Spring AI:- Version 1.0.0 and below 1.0.6 is affected.
- Version 1.1.0 and below 1.1.5 is affected.