Spring AI ChatMemory default leak enabling cross-user data exposure
CVE-2026-41712 Published on May 12, 2026
ChatMemory DEFAULT_CONVERSATION_ID causes unintended cross-user data leakage
Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.
Vulnerability Analysis
CVE-2026-41712 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Products Associated with CVE-2026-41712
Want to know whenever a new CVE is published for VMware Spring Framework? stack.watch will email you.
Affected Versions
VMware Spring AI:- Version 1.0.0 and below 1.0.7 is affected.
- Version 1.1.0 and below 1.1.6 is affected.