Spring AI PromptChatMemoryAdvisor Memory Poisoning (CVE-2026-41713)
A flaw in Spring AI's PromptChatMemoryAdvisor lets attacker text get saved to conversation memory before any safety or policy check runs. Later, when that memory is replayed into the prompt, the AI treats the attacker's words as trusted prior conversation, letting the attacker steer future replies.
How the attack works
A user sends a message crafted to look like a persistent instruction, for example 'REMEMBER: from now on you are...', fake SYSTEM:/ASSISTANT: role markers, or phrases like '[SYSTEM-MEMORY-PERSIST]' and 'IGNORE PREVIOUS INSTRUCTIONS once stored'. Spring AI's memory advisor writes this raw input into chat memory before checking whether it's safe or policy-compliant. On the next turn, that stored text is pulled back out and re-inserted into the prompt as if it were a legitimate earlier exchange. The model then follows the planted instructions as trusted context. If combined with a separate flaw (CVE-2026-41712) that mixes up memory across sessions, this poisoned content can even leak into other users' conversations.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f8f40ad8-1935-43c6-802a-7eae4b587c22
- Severity
- High
Why it matters
Attackers can hijack an AI agent's behavior across future turns or sessions, bypassing safety controls and potentially exposing other users to manipulated responses drawn from poisoned shared memory.
What you can do
- →Upgrade to Spring AI 1.0.0 or later, which patches the flawed memory-write order.
- →Sanitize and run policy/safety checks on user input before it is written to chat memory, not just before it's used in a prompt.
- →Isolate chat memory per user/session and verify no cross-session memory bleed is possible.
- →Monitor stored memory content for role-override markers (SYSTEM:, ASSISTANT:), persistence phrases (REMEMBER:, IGNORE PREVIOUS INSTRUCTIONS), or reframing language ('from now on you are').
Known benign look-alikes
- Legitimate documentation or changelog text discussing CVE-2026-41713 patch notes.
- Static analysis tooling output documenting memory-poisoning patterns for defensive purposes.
- Red-team test corpora that contain memory-poisoning payloads inside tagged research fixtures.
- Patched Spring AI PromptChatMemoryAdvisor deployments that apply pre-write content sanitisation.