CVE-2026-22730

CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.

Affected

VMware · Spring AI

CVSS v3.1 VMWARE

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.53% chance of exploitation in the next 30 days, 44th percentile

Published

2026-03-18

Updated

2026-03-19

Proof-of-concept exploits (1)

• NULL200OK/CVE-2026-22730-Scanner2★ · 2026-03-20

Security advisories

• https://spring.io/security/cve-2026-22730
• advisories/GHSA-c267-rfvc-mvpm

References

• CVE Record
• NVD entry

Related

• CVE-2025-41244
• CVE-2026-27944
• CVE-2026-3228
• CVE-2026-32302
• CVE-2026-34621
• CVE-2026-41940