Cyber Resilience

CVE-2026-41712

High

Published: 12 May 2026

Published
12 May 2026
Modified
12 May 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0004 14.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-41712 is a high-severity Incorrect Default Permissions (CWE-276) vulnerability in Vmware Spring Ai. Its CVSS base score is 7.5 (High).

Operationally, ranked at the 14.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

This vulnerability is AI-related — categorised as NLP and Transformers; in the Privacy and Disclosure risk domain.

EU & UK References

Vulnerability details

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

CWE(s)

AI Security AnalysisAI

AI Category
NLP and Transformers
Risk Domain
Privacy and Disclosure
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: ai

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

Insufficient information to map techniques.
Confidence: LOW · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-22744Same product: Vmware Spring Ai
CVE-2026-22743Same product: Vmware Spring Ai
CVE-2026-41705Same product: Vmware Spring Ai
CVE-2026-22738Same product: Vmware Spring Ai
CVE-2026-40978Same product: Vmware Spring Ai
CVE-2026-22730Same product: Vmware Spring Ai
CVE-2026-22742Same product: Vmware Spring Ai
CVE-2026-22729Same product: Vmware Spring Ai
CVE-2026-40967Same product: Vmware Spring Ai
CVE-2026-41713Same product: Vmware Spring Ai

Affected Assets

vmware
spring ai
1.0.0 — 1.0.7 · 1.1.0 — 1.1.6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-276

Access control policy can specify and enforce secure default permissions for resources.

addresses: CWE-276

Guides setting of default permissions to the minimum required level.

addresses: CWE-276

Establishes requirements for appropriate default permissions on system resources as part of configuration management.

addresses: CWE-276

Baseline establishment and updates on install/upgrade ensure correct default permissions rather than insecure ones.

addresses: CWE-276

Requiring the most restrictive settings instead of defaults prevents incorrect default permissions on resources.

addresses: CWE-276

Requires documented processes that include setting and maintaining correct default permissions for configuration items.

addresses: CWE-276

Requires addressing secure default permissions in physical and environmental protection controls.

addresses: CWE-276

Tailoring explicitly overrides or scopes default permission assignments in the baseline to match the system's actual risk and operational needs.

References