CVE-2026-22729

Estado: AnalizadaAlta (8.6)—

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.

This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.

The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries.

Leer descripción completaMostrar menos

Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Puntuación base: 8.6

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.53%
Percentil entre todas las CVEs puntuadas: 43
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1005 Data from Local Systemcollection90 %
Impacto secundarioT1556 Modify Authentication Processdefense impairment · persistence · credential access70 %

JSONPath injection en aplicación expuesta permite a usuarios autenticados bypassear controles de acceso y acceder a documentos no autorizados mediante expressions malformadas sin sanitizar.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Vulnerability Scanning User Account Management Restrict File and Directory Permissions Restrict Registry Permissions Privileged Process Integrity

Tecnologías afectadas (1)

Vmware — Spring AI

CWE

CWE-917

Referencias

https://spring.io/security/cve-2026-22729

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-22729",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-22729",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-18T14:50:07.381087Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@vmware.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@vmware.com",
      "affectedData": [
        {
          "vendor": "VMware",
          "product": "Spring AI",
          "versions": [
            {
              "status": "affected",
              "version": "1.0.x",
              "lessThan": "1.0.4",
              "versionType": "OSS"
            },
            {
              "status": "affected",
              "version": "1.1.x",
              "lessThan": "1.1.3",
              "versionType": "oss"
            }
          ],
          "packageName": "Spring AI",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-03-18T08:16:31.000",
  "references": [
    {
      "url": "https://spring.io/security/cve-2026-22729",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@vmware.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-917"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents.\n\nThis vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata.\n\nThe vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like \", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de inyección de JSONPath en el AbstractFilterExpressionConverter de Spring AI permite a usuarios autenticados eludir los controles de acceso basados en metadatos mediante expresiones de filtro manipuladas. La entrada controlada por el usuario pasada a FilterExpressionBuilder se concatena en consultas JSONPath sin el escape adecuado, lo que permite a los atacantes inyectar lógica JSONPath arbitraria y acceder a documentos no autorizados.\n\nEsta vulnerabilidad afecta a las aplicaciones que utilizan almacenes vectoriales que extienden AbstractFilterExpressionConverter para aislamiento multi-inquilino, control de acceso basado en roles o filtrado de documentos basado en metadatos.\n\nLa vulnerabilidad ocurre cuando los valores proporcionados por el usuario en las expresiones de filtro no se escapan antes de ser insertados en las consultas JSONPath. Caracteres especiales como '\"', '||' y '&amp;&amp;' se pasan sin escapar, lo que permite la inyección de lógica JSONPath arbitraria que puede alterar la semántica de la consulta prevista."
    }
  ],
  "lastModified": "2026-06-17T10:20:18.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F510851F-2162-4380-97A0-75456BC7875A",
              "versionEndExcluding": "1.0.4",
              "versionStartIncluding": "1.0.0"
            },
            {
              "criteria": "cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34C3CF7E-1A85-4EFE-8CC0-03E85527B2D5",
              "versionEndExcluding": "1.1.3",
              "versionStartIncluding": "1.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@vmware.com"
}