CVE-2026-22730
Critical SQL Injection in Spring AI MariaDBFilterExpressionConverter
Publication date: 2026-03-18
Last updated on: 2026-04-01
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| vmware | spring_ai | From 1.0.0 (inc) to 1.0.4 (exc) |
| vmware | spring_ai | From 1.1.0 (inc) to 1.1.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22730 is a critical SQL injection vulnerability in the MariaDBFilterExpressionConverter component of Spring AI. It occurs because of missing input sanitization, which allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized access to sensitive data, modification or deletion of data, and disruption of service availability. Because attackers can execute arbitrary SQL commands, they can compromise confidentiality, integrity, and availability of the affected system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-22730 vulnerability, users should upgrade Spring AI to fixed versions.
- Upgrade to version 1.0.4 if using the 1.0.x branch.
- Upgrade to version 1.1.3 if using the 1.1.x branch.
No additional mitigation steps are required beyond upgrading.