CVE-2026-22744: Redis Injection in Spring AI Redis Store

An attacker exploiting this vulnerability can inject arbitrary RediSearch commands by crafting malicious filter values. This could lead to data exfiltration, denial of service, or even remote code execution if RediSearch is configured to allow external connections. The severity stems from the potential to manipulate the underlying Redis database and execute commands with the privileges of the Spring AI application. This is particularly concerning in environments where Spring AI is used to process sensitive data or interact with critical systems. The lack of proper escaping allows attackers to bypass intended security controls and gain unauthorized access.

1. Reserved2026-01-09
2. Published2026-03-27
3. Modified2026-03-29
4. EPSS updated2026-04-03

The primary mitigation is to upgrade to version 1.0.5 or later of spring-ai-redis-store. If upgrading immediately is not feasible, consider implementing input validation and sanitization on all user-provided filter values before passing them to the RedisFilterExpressionConverter. Additionally, restrict access to the Redis instance to only trusted sources and review RediSearch configuration to minimize potential attack surface. Monitor Redis logs for unusual activity or unexpected commands. After upgrading, verify the fix by attempting to inject a simple RediSearch command through a TAG filter and confirming it is properly escaped and not executed.