CVE-2026-41705General(vmware / spring_ai)

LOWCVSS 8.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Spring AI 1.0.x: affected from 1.0.0 through latest 1.0.x; upgrade to 1.0.7 or greater. Spring AI 1.1.x: affected from 1.1.0 through latest 1.1.x; upgrade to 1.1.6 or greater.

vmware CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://spring.io/security/cve-2026-41705

Weakness type (CWE)

CWE-917

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

spring_ai

Threat summary

6 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 1 signal
General: 4 classified signals
Disclosure: 2 classified signals
Peaked 3d ago at 2 mentions (2026-05-09); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

vmware

Products

spring_ai

Deep dive

Activity timeline6 mentions / 4d

Signal classification2 categories

General

466.7%

Disclosure

233.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-09	2	General2
2026-05-10	2	Disclosure1General1
2026-05-12	1	General1
2026-05-27	1	Disclosure1

Full discourse6 posts

CERT-PY@CERTpy134d
Disclosure
⚠️ Vulnerabilidades en productos Spring ❗ CVE-2026-41713 ❗ CVE-2026-41712 ❗ CVE-2026-41705 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-spring-8/ https://t.co/oh7e2aKL4M
Post summary
The tweet announces three new vulnerabilities (CVE‑2026‑41713, CVE‑2026‑41712, CVE‑2026‑41705) affecting Spring products, directing readers to a CERT advisory for additional information.
0000195
6.7K followersView on X
CVEarity@CVEarity152d
General
⚡ New CVE Alert: CVE-2026-41705 📊 Severity: 8.6 🚨 Risk Level: High 🧩 Affects: Multiple / Unspecified Products Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-41705 #CVE-2026-41705 #CVE #High #CyberSecurity #InfoSec https://t.co/L9wuw7Qunc
Post summary
The tweet merely announces CVE‑2026‑41705 with a severity score, linking to NVD, but provides no technical, exploit, or patch details.
0001091
157 followersView on X
Vignesh_Pravin@VigneshVic23698150d
General
CVE-2026-41705: Spring AI Flaw Lets Attackers Destroy Data https://thecybrdef.com/cve-2026-41705-spring-ai-data-destruction-vulnerability/ #SpringAIFlaws #Cybertrending #Cybersecurity
Post summary
The content provides only a headline and link, lacking specific technical or actionable information about the CVE.
0000029
2 followersView on X
cybersecuritypath@cybrsecpath151d
Disclosure
CVE-2026-41705: Spring AI Flaw Lets Attackers Destroy Data https://thecybrdef.com/cve-2026-41705-spring-ai-data-destruction-vulnerability/ #SpringAIFlaws #Cybertrending #Cybersecurity
Post summary
A new vulnerability, CVE‑2026‑41705, is announced as a Spring AI flaw that could let attackers destroy data, but the post offers no technical details, exploit code, or patch information.
0000028
9 followersView on X
selva@SelvaKtm2152d
General
CVE-2026-41705: Spring AI Flaw Lets Attackers Destroy Data https://thecybrdef.com/cve-2026-41705-spring-ai-data-destruction-vulnerability/ #SpringAIFlaws #Cybertrending #Cybersecurity https://t.co/QwSQXmEfLU
Post summary
The tweet announces CVE‑2026‑41705 as a Spring AI flaw that could destroy data, but it provides neither technical details nor evidence of exploitation, PoC, or patch information.
0000017
5 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds152d
General
CVE-2026-41705 Filter Expression Injection in Spring AI MilvusVectorStore doDelete Method https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41705
Post summary
CVE-2026-41705 is a filter expression injection in Spring AI's MilvusVectorStore doDelete method, with details referenced via a vulnerability database link.
0000044
4.0K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	vmware	spring_ai	-	-	-

Explore more

Back to dashboard vmware CVEs spring_ai vulnerabilities

What researchers are saying

CVE-2026-41705

CERT-PY@CERTpyDisclosure

The tweet announces three new vulnerabilities (CVE‑2026‑41713, CVE‑2026‑41712, CVE‑2026‑41705) affecting Spring products, directing readers to a CERT advisory for additional information.

CVEarity@CVEarityGeneral

The tweet merely announces CVE‑2026‑41705 with a severity score, linking to NVD, but provides no technical, exploit, or patch details.

Vignesh_Pravin@VigneshVic23698General

The content provides only a headline and link, lacking specific technical or actionable information about the CVE.

cybersecuritypath@cybrsecpathDisclosure

A new vulnerability, CVE‑2026‑41705, is announced as a Spring AI flaw that could let attackers destroy data, but the post offers no technical details, exploit code, or patch information.

selva@SelvaKtm2General

The tweet announces CVE‑2026‑41705 as a Spring AI flaw that could destroy data, but it provides neither technical details nor evidence of exploitation, PoC, or patch information.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

CVE-2026-41705 is a filter expression injection in Spring AI's MilvusVectorStore doDelete method, with details referenced via a vulnerability database link.