CVE-2026-22730 — CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter

CVE-2026-22730

CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter PUBLISHED

Description (CNA)

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.

Affected (CNA)

Vendor / product	Versions
VMware / Spring AI	affected 1.0.x before 1.0.4; affected 1.1.x before 1.1.3

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-22730

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.