# Spring AI SQLi flaw bypasses security policy

Published: 2026-06-15 · Severity: medium
Canonical: https://vorant.io/reports/872d2090-15a6-4af9-aa1a-ae59815e3865/spring-ai-sqli-flaw-bypasses-security-policy

> A SQL injection vulnerability in Spring AI versions before 1.0.9 and 1.1.8 allows attackers to bypass security policies.

The French national CERT has issued an advisory for a SQL injection vulnerability in Spring AI, tracked as CVE-2026-47835. The flaw affects Spring AI versions 1.0.x prior to 1.0.9 and versions 1.1.x prior to 1.1.8. Successful exploitation allows an attacker to perform SQL injection attacks and bypass the application's security policy.

The vulnerability represents a standard injection weakness in the Spring AI framework. Organizations using affected versions should prioritize patching, as SQL injection vulnerabilities can lead to unauthorized data access, data manipulation, and potential escalation of privileges depending on database configuration and application context.

Spring has released security patches in versions 1.0.9 and 1.1.8 to address the vulnerability. Users are advised to consult the vendor's security bulletin for detailed remediation guidance and upgrade to the patched versions.

## Mentioned in this report

- Vulnerabilities: CVE-2026-47835

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0751

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/872d2090-15a6-4af9-aa1a-ae59815e3865/spring-ai-sqli-flaw-bypasses-security-policy.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup