CVE-2026-40978 | Vmware Spring AI up to 1.0.5/1.1.4 Document ID CosmosDBVectorStore sql injection

A vulnerability, which was classified as critical, has been found in Vmware Spring AI up to 1.0.5/1.1.4. Affected is the function CosmosDBVectorStore of the component Document ID Handler. This manipulation causes sql injection.

This vulnerability is handled as CVE-2026-40978. The attack can be initiated remotely. There is not any exploit available.

It is advisable to upgrade the affected component.