Database/AI/ML frameworks & serving
Spring AI: predictable ONNX model cache path lets a local user plant a substitute model file
Impact
Spring AI caches its ONNX model file at a deterministic path, so a local user on a shared host can create that path first and leave a model of their own choosing there for the application to load. Whatever the application does with that model - embeddings, classification, ranking - is then produced by attacker-supplied weights and graph, which the vendor scores as an integrity compromise with no confidentiality or availability impact. The practical concern on a shared inference host is silent output substitution rather than a crash: nothing about the service looks wrong afterwards. Note that the published CVSS vector says network attack vector while the vendor description explicitly describes a local attacker on a multi-user host; treat the local description as the accurate one for exposure planning.
Who can reach it
A local unprivileged user on the same host as the Spring AI application, able to create the cache path before the application populates it. No authentication to the application itself is required.
What to do
Follow the Spring advisory for the fixed release; the record identifies Spring AI 2.0.0, 1.1.0-1.1.8 and 1.0.0-1.0.9 as affected but does not state a fixed version, so confirm it at spring.io/security/cve-2026-47852 before scheduling. Applying it means redeploying and restarting the application, not touching the node. Independently, delete and re-create any existing cache file whose provenance you cannot vouch for, and avoid running the serving JVM on a host shared with untrusted local users.
References
Related entries
- Ollama (quantization engine): Unauthenticated remote information disclosure — reads and exfiltrates model dataCVE-2026-5757 · Ollama (quantization engine)High
- NVIDIA NemoClaw for Linux: installer downloads code without an integrity checkCVE-2026-65097 · NVIDIA NemoClaw for Linux (installation scripts)High
- Ollama (GGUF metadata parser): Uncontrolled memory allocationCVE-2026-65315 · Ollama (GGUF metadata parser)High
- Milvus: Unauthenticated DoS terminating service componentsCVE-2026-69111 · MilvusHigh
- BentoML 1.3.9 (bundled Gradio app, /login endpoint): The /login endpoint of the integrated Gradio app processes eachNCVD-2025-016-bentoml-1-3-9-bundled-gradio-app · BentoML 1.3.9 (bundled Gradio app, /login endpoint)High
- UpTrain: authenticated remote code execution via the checks and metadata parameters on /create_projectCVE-2025-27770 · UpTrain dashboard backend (/create_project endpoint)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.