CVE-2026-40966 — In Spring AI, an attacker can bypass conversation isolation

title: Spring AI Conversation Isolation Bypass via conversationId injection - CVE-2026-40966
id: scw-2026-04-28-ai-1
status: experimental
level: critical
description: |
  Detects attempts to exploit CVE-2026-40966 by injecting malicious logic into the conversationId parameter of a web request targeting a Spring AI application. This injection can bypass conversation isolation, allowing an attacker to exfiltrate sensitive data from other users' chat histories. This rule specifically looks for POST requests to common API chat endpoints containing the 'conversationId=' parameter in the query string, which is a key indicator of the exploit attempt.
author: SCW Feed Engine (AI-generated)
date: 2026-04-28
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-40966/
tags:
  - attack.defense_evasion
  - attack.t1537
logsource:
    category: webserver
detection:
  selection:
      cs-uri-query|contains:
          - 'conversationId='
      cs-uri|contains:
          - '/api/chat'
      cs-method|exact:
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse