CVE-2026-47852 in Spring
Summary
by MITRE • 08/27/2026
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.0 - 1.0.9
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability described involves a local privilege escalation or code execution risk within the Spring AI framework, specifically affecting versions from 1.0.0 through 1.0.9 and 1.1.0 through 1.1.8, as well as version 2.0.0. This flaw stems from an insecure handling of file system paths when loading Open Neural Network Exchange (ONNX) models. In a multi-user environment where multiple processes or users share the same host resources, the application relies on deterministic cache paths to store and retrieve model artifacts. The core technical deficiency lies in the failure to validate whether these pre-existing paths are under the control of an untrusted local user before writing or executing files within them. This creates a classic race condition scenario where an attacker can manipulate the file system state prior to the application's execution flow reaching the point of loading the model.
An attacker with local access on such a multi-user host can exploit this by pre-creating the specific directory structure that Spring AI expects for its cache mechanism. By doing so, they gain control over the location where the framework will attempt to write or read data. The attacker then plants a malicious ONNX model file within this controlled path. When the vulnerable application subsequently attempts to load an ONNX model using the deterministic cache logic, it may inadvertently interact with the pre-planted file instead of generating or fetching a legitimate one. Depending on how the framework processes the ONNX graph and executes inference operations, this could lead to arbitrary code execution if the malicious model contains crafted operators that exploit parser vulnerabilities within the underlying ONNX runtime library. Even without direct remote code execution via the runtime itself, the ability to write files into expected cache directories can facilitate further attacks such as data poisoning or denial of service by corrupting legitimate cached models.
The operational impact is significant for organizations running Spring AI applications on shared infrastructure like virtual machines, containers with persistent volumes, or traditional multi-tenant servers. Local attackers who have gained any level of access to the system could potentially escalate their privileges if the application runs with elevated permissions relative to the attacker. Furthermore, this vulnerability compromises the integrity of machine learning workloads by allowing unauthorized modification of model artifacts. This aligns with CWE Category 732: Incorrect Permission Assignment for Critical Resource, as the application fails to enforce proper ownership and access controls on cache directories. It also relates to CWE Category 506: Embedded Malicious Code if the malicious ONNX file is interpreted as a vector for injecting harmful logic into the execution pipeline. From an ATT&CK perspective, this technique falls under T1496: Resource Hijacking or potentially T1059 Command and Scripting Interpreter if the model execution triggers script-like behavior through custom operators in the neural network graph.
Mitigation strategies must focus on securing file system interactions and enforcing strict access controls. The most effective immediate mitigation is to upgrade Spring AI to a version that addresses this path validation flaw, ensuring that cache directories are created with restrictive permissions such as 0700 or using secure temporary directory APIs like java.nio.file.Files.createTempDirectory which guarantees uniqueness and prevents pre-creation attacks by other users. Administrators should also implement mandatory access control systems like SELinux or AppArmor to restrict write access to application-specific cache paths for non-root, untrusted local users. Additionally, validating the integrity of loaded models using cryptographic hashes before execution can prevent the use of tampered ONNX files. Regular auditing of file permissions and monitoring for unexpected changes in cache directories can also help detect exploitation attempts early.