Description

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI: 2.0.0

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-08-21T12:16:30.270Z",
  "pubdate": "2026-08-21T12:16:30.270Z",
  "executiveSummary": "A context isolation vulnerability exists in the Semantic Cache support mechanism of Spring AI version 2.0.0. The vulnerability stems from flaws in the context hash generation logic intended to isolate cached responses between distinct system prompts. As a result of this improper context isolation, cached responses can be inappropriately shared across entirely unrelated execution contexts and system prompts.\nThe primary impact of this flaw is the potential cross-contamination of cached data, where sensitive or context-specific information generated for one user or system prompt may be returned to an unauthorized or unrelated context. This introduces significant data leakage and integrity risks within AI-driven applications utilizing Spring AI caching features.\nThe affected product is Spring AI version 2.0.0. Exploitation requires an attacker to interact with the application in a manner that triggers cache generation and retrieval across shared semantic spaces where context collision or hash degradation occurs. The risk implications include unauthorized access to cached LLM responses, potential exposure of proprietary system prompts or user-specific data, and subversion of application logic relying on prompt isolation.",
  "technicalDetails": "The vulnerability resides within the Semantic Cache support component of Spring AI 2.0.0, specifically in the mechanisms responsible for computing and verifying context hashes. The root cause is the inadequate or flawed generation of the cryptographic or hashing identifier used to segregate cached semantic responses based on distinct system prompts and surrounding operational contexts.\nIn a secure semantic caching implementation, the context hash must uniquely bind the cached LLM output to the specific input parameters, including the system prompt, user prompt, and relevant environmental state. In Spring AI 2.0.0, the context hash calculation fails to sufficiently differentiate between disparate system prompts or contextual parameters. Consequently, distinct execution contexts can yield colliding or overlapping hash values.\nThe step-by-step attack flow involves the following mechanics: First, an initial interaction establishes a cached entry populated with a specific system prompt and associated output. Second, a subsequent interaction utilizing an unrelated or distinct system prompt generates a query that maps to the same flawed context hash due to insufficient entropy or improper weighting in the hashing algorithm. Third, the caching subsystem retrieves and returns the previously cached response intended for the initial context, rather than executing a fresh inference or recognizing the context discrepancy.\nThe vulnerable component is the Semantic Cache support within Spring AI version 2.0.0. Exploitation does not inherently require advanced authentication or elevated privileges beyond the ability to interact with the application's AI endpoints and submit prompts that manipulate the semantic cache state. Network exposure depends on the deployment architecture of the Spring AI application, typically affecting services exposed via REST APIs or internal service meshes. The post-exploitation impact is characterized by unauthorized information disclosure, data leakage between isolated sessions, and potential manipulation of application behavior through poisoned or cross-contaminated cache entries."
}