CVE-2026-40979 - In Spring AI, having access to a shared environment can expose the ONNX model used by the application

MEDIUM

In Spring AI, having access to a shared environment can expose the ONNX model used by the application

Published Apr 28, 2026

6.1

MEDIUM

CVSS 3.1

EPSS 0.15%

In Spring AI, having access to a shared environment can expose the ONNX model used by the application.

Affected versions: Spring AI: 1.0.0 - 1.0.5 (fixed in 1.0.6), 1.1.0 - 1.1.4 (fixed in 1.1.5)

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
1.0.0	affected	<1.0.6
1.1.0	affected	<1.1.5

No remediation recorded yet.

Weaknesses (1)

CWE-377

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26012		Advisory
https://github.com/advisories/GHSA-r5hp-3cgj-j6xv		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-40979
https://spring.io/security/cve-2026-40979		Vendor Advisory