Spring AI MilvusVectorStore Filter Expression Injection (CVE-2026-41705)
Spring AI applications using MilvusVectorStore build database filter queries by pasting user or LLM-generated text directly into the query string. An attacker can craft input that breaks out of the intended filter and adds their own conditions, letting them read or delete vector database entries they should not have access to.
How the attack works
An application passes user input, or text generated by an LLM, into MilvusVectorStore's delete() or similaritySearch() calls, which build a Milvus DSL filter expression by string concatenation rather than parameterised queries. An attacker inserts an unbalanced quote or a boolean operator (or, and) to escape the intended clause, then appends new Milvus operators (==, in[, like) or terminators (;, --) to widen the scope of the query. This can override access-control filters that were meant to restrict results to the attacker's own data, or turn a narrow delete into a bulk wipe of the collection. The technique also includes known escape-bypass tricks such as like '%' ESCAPE '\\' to defeat basic input sanitisation.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- bc7df529-c29c-4c1f-9859-410c6f258299
- Severity
- High
- CVEs
- CVE-2026-41705
Why it matters
An attacker can read vector store entries outside their authorized scope, or delete arbitrary records in the collection, potentially destroying retrieval-augmented generation data or bypassing tenant/access isolation built into the application logic.
What you can do
- →Upgrade to Spring AI >= 1.0.0, which patches this issue with parameterised filter construction.
- →If you cannot upgrade immediately, never concatenate raw user input or LLM output directly into Milvus filter expressions; use a parameterised or allow-listed filter builder instead.
- →Review any code paths where LLM-generated text feeds into vector store filter, delete, or search calls, and add strict validation rejecting quotes, boolean operators, and DSL keywords from untrusted input.
- →Monitor for filter-context inputs containing unbalanced quotes, chained boolean operators, or trailing terminators as a sign of attempted exploitation.
Known benign look-alikes
- Legitimate documentation or changelog text discussing CVE-2026-41705 patch notes.
- Static analysis tooling output documenting Milvus filter injection patterns for defensive purposes.
- Patched Spring AI MilvusVectorStore deployments that use parameterised filter builders.