CVE-2026-47835: Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

Synopsis

A query-injection vulnerability in Spring AI's vector store integrations (spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store) allows an unauthenticated remote attacker to inject special characters into metadata filter expressions and force the execution of arbitrary queries against the underlying vector database. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates the service must be reachable over a network and requires no authentication or user interaction to exploit. Successful exploitation gives the attacker read access to stored vector data and limited ability to tamper with or disrupt query results. Patched-image rebuilds at versions 1.0.9 and 1.1.8 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Spring AI application over the network; any internet- or intranet-exposed deployment is in scope.

• AuthenticationNot required

  No credentials are needed; the injection can be triggered through unauthenticated metadata filter inputs.

• Victim interactionNot required

  Exploitation is fully automated and requires no action from any user or administrator.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required to inject and execute arbitrary queries.

Blast Radius

• An attacker can extract stored vector embeddings and associated metadata records from the affected Elasticsearch, OpenSearch, or GemFire vector store.
• Injected queries can manipulate filter logic to return or suppress specific documents, corrupting the results that downstream AI features rely on.
• Service responsiveness can be degraded by forcing expensive or malformed queries through the injection point.