Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-22730

34
FAUCET Score

CVE-2026-22730 is a critical SQL injection vulnerability (CVSS 8.8 HIGH) in Spring AI's MariaDBFilterExpressionConverter, caused by missing input sanitization. This flaw allows attackers with low privileges to bypass metadata-based access controls and execute arbitrary SQL commands over the network, leading to high impact on confidentiality, integrity, and availability. While not currently listed in CISA's KEV catalog and lacking public exploit code, it is on the Hot List and has generated significant community discussion, indicating active monitoring and potential for future exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
>= 1.0.0, < 1.0.4CPE matchmatch criteria
cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*
>= 1.1.0, < 1.1.3CPE matchmatch criteria
cpe:2.3:a:vmware:spring_ai:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.8HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.52%
Probability of exploitation in next 30 days
EPSS Percentile
41.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0052 is in the 31st percentile among its peer group of 17,829 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

mavenpatch availablevia ghsa
Product: org.springframework.ai:spring-ai-mariadb-storeFixed in: 1.1.3
mavenpatch availablevia ghsa
Product: org.springframework.ai:spring-ai-mariadb-storeFixed in: 1.0.4
power_bivendor investigatingvia llm_extracted

Vendor Advisories (2)

mavenGHSA-c267-rfvc-mvpmhigh

SQL Injection in Spring AI MariaDBFilterExpressionConverter

Mar 18, 2026
power_billm-power_bi-6d0afe006e3517bdHIGH

SQL Injection in Spring AI MariaDBFilterExpressionConverter

Mar 17, 2026

References

spring.io / security/cve-2026-22730
Vendor Advisory