PT-2026-25940 · Vmware · Spring-Ai-Mariadb-Store+2

Blackf0G · Publicado 2026-03-17 · Atualizado 2026-04-10 · CVE-2026-22730

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Spring AI versions prior to 1.0.4 Spring AI versions prior to 1.1.3

Description A critical SQL injection flaw exists in Spring AI's MariaDBFilterExpressionConverter component. This issue allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The root cause is a lack of input sanitization when processing user-provided filter expressions, leading to the construction of vulnerable SQL queries. The vulnerability affects applications utilizing spring-ai-vector-store or spring-ai-mariadb-store with user-controlled filter expressions. The vulnerability allows attackers to manipulate database queries without authentication.

Recommendations For Spring AI versions prior to 1.0.4, upgrade to version 1.0.4 or later. For Spring AI versions prior to 1.1.3, upgrade to version 1.1.3 or later.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2026-04970

CVE-2026-22730

GHSA-C267-RFVC-MVPM

Produtos afetados

Spring Ai

Spring-Ai-Mariadb-Store

Spring-Ai-Vector-Store

Referências · 24

• https://github.com/spring-projects/spring-ai · Nota
• https://github.com/spring-projects/spring-ai/releases/tag/v1.0.4 · Nota
• https://github.com/spring-projects/spring-ai/releases/tag/v1.1.3 · Nota
• https://twitter.com/prabhatdotdev/status/2035968702466970022 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2034188961397068235 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/2033913389785715039 · Publicação no Twitter
• https://reddit.com/r/pwnhub/comments/1rxfb5t/critical_sql_injection_flaw_discovered_in_spring · Publicação no Reddit
• https://twitter.com/abcas_mcp_guard/status/2042415575344038082 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2034365309243846944 · Publicação no Twitter
• https://twitter.com/ptdbugs/status/2035989958708580751 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2034208174551748726 · Publicação no Twitter
• https://reddit.com/r/java/comments/1s0si5o/spring_ai_vector_store_has_two_high_injection · Publicação no Reddit
• https://reddit.com/r/SpringBoot/comments/1s0skgk/psa_spring_ai_104_113_patches_two_injection_vulns · Publicação no Reddit
• https://twitter.com/0dayPublishing/status/2034282235122127193 · Publicação no Twitter
• https://spring.io/security/cve-2026-22730 · Aviso do Fabricante