CVE-2026-22730

published 2026-03-18

CVE-2026-22730: A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute…

Priority P3 59 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.

The vulnerability exists due to missing input sanitization.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
vmware	spring_ai	>= 1.0.0 < 1.0.4	1.0.4
vmware	spring_ai	>= 1.0.x < 1.0.4	1.0.4
vmware	spring_ai	>= 1.1.0 < 1.1.3	1.1.3
vmware	spring_ai	>= 1.1.x < 1.1.3	1.1.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89