# Spring AI ChatMemory Cross-User Memory Leakage (CVE-2026-41712)

- **Severity:** High
- **Signature ID:** `06d3d0c4-3e95-4bf6-8c3d-acbe7f79970d`
- **CVEs:** CVE-2026-41712
- **MITRE ATLAS:** AML.T0024 (Exfiltration via AI Inference API), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI09 (Traceability and Accountability Gaps), LLM02 (Sensitive Information Disclosure), LLM08 (Vector and Embedding Weaknesses)

## Summary

A flaw in Spring AI's PromptChatMemoryAdvisor (CVE-2026-41712) can mix up conversation memory between users. When the memory store isn't properly separated by conversation ID, one user's prior messages, tool outputs, and role tags can be pulled into a completely different user's chat and fed to the AI model on their behalf.

## How the attack works

An application uses Spring AI's ChatMemory feature to give the AI model context from earlier turns in a conversation. If the advisor doesn't enforce a unique conversation_id per session, two unrelated requests can end up sharing the same memory bucket. Memory written by User A during their session is then retrieved and silently injected into User B's prompt as though it were B's own history. The model processes A's private content on B's behalf, and B may see or receive responses shaped by A's data without either user knowing it happened.

## Why it matters

Private conversation content, prior queries, and tool outputs from one user can be exposed to a different, unrelated user, which is a direct confidentiality breach and a compliance problem for any application handling sensitive or regulated user data.

## What you can do

- Upgrade to Spring AI 1.0.0 or later, which fixes this issue.
- Confirm every request to a ChatMemory-backed advisor carries a unique, correctly scoped conversation_id and that it's enforced server-side, not just client-supplied.
- Audit memory-fetch logs for cases where the retrieved user-id or conversation-id doesn't match the active session.
- Review stored chat memory for any cross-session mixing, especially in multi-tenant or high-concurrency deployments.

## Known benign look-alikes

- Legitimate documentation or changelog text discussing CVE-2026-41712 patch notes.
- Static analysis tooling output documenting cross-user memory leakage patterns for defensive purposes.
- Patched Spring AI PromptChatMemoryAdvisor deployments that enforce per-conversation_id partitioning.
- Multi-tenant test fixtures that intentionally include foreign conversation IDs for QA purposes.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00449
- https://nvd.nist.gov/vuln/detail/CVE-2026-41712

---
Source: https://www.netzilo.com/threats/atr-spring-ai-chatmemory-cross-user-memory-leakage-cve-2026-4171