Spring AI Filter Expression Injection via Unescaped Query Parameters

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to specific vector store query languages. In several cases, keys and values are not properly escaped, leading to the ability to alter the query. Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Spring AI's FilterExpressionConverter implementations fail to properly escape keys and values when translating filter expressions into vector store query languages, enabling query injection attacks. This vulnerability affects Spring AI versions 1.0.0-1.0.5 and 1.1.0-1.1.4, with fixes available in 1.0.6 and 1.1.5 respectively. Organizations using Spring AI for vector database operations—particularly those integrating AI-powered search, retrieval-augmented generation (RAG), or semantic search features—face significant risk. An attacker can manipulate filter expressions to alter database queries, potentially bypassing access controls, extracting unauthorized data, or modifying stored vectors and metadata. The CVSS 8.6 rating reflects the high severity of this input validation flaw in a widely-used AI framework.

Casky's security skills detect the attack patterns associated with T1059 (Command and Scripting Interpreter) and T1190 (Exploit Public-Facing Application) through Claude AI's extended reasoning capabilities. When analyzing logs and application behavior, Casky identifies suspicious filter expression patterns—malformed or syntactically unusual query parameters that indicate injection attempts—combined with unexpected query language constructs in vector store communications. A practitioner reviewing Casky findings would see detection of abnormal FilterExpressionConverter processing, anomalous query syntax generation, and potential lateral movement through data exfiltration attempts via manipulated filter logic. The platform correlates these indicators with known Spring AI versions to flag vulnerable deployments and highlight instances where query injection payloads are being processed or executed against backend vector stores.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-40967.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-40967

Casky has 301 skills that investigate the attack patterns behind CVE-2026-40967. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn