PT-2026-25940 · Vmware · Spring-Ai-Mariadb-Store+2

Blackf0G · Published 2026-03-17 · Updated 2026-04-10 · CVE-2026-22730

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Spring AI versions prior to 1.0.4 Spring AI versions prior to 1.1.3

Description A critical SQL injection flaw exists in Spring AI's MariaDBFilterExpressionConverter component. This issue allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The root cause is a lack of input sanitization when processing user-provided filter expressions, leading to the construction of vulnerable SQL queries. The vulnerability affects applications utilizing spring-ai-vector-store or spring-ai-mariadb-store with user-controlled filter expressions. The vulnerability allows attackers to manipulate database queries without authentication.

Recommendations For Spring AI versions prior to 1.0.4, upgrade to version 1.0.4 or later. For Spring AI versions prior to 1.1.3, upgrade to version 1.1.3 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-04970

CVE-2026-22730

GHSA-C267-RFVC-MVPM

Affected Products

Spring Ai

Spring-Ai-Mariadb-Store

Spring-Ai-Vector-Store

References · 24

• https://spring.io/security/cve-2026-22730 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22730 · Security Note
• https://bdu.fstec.ru/vul/2026-04970 · Security Note
• https://osv.dev/vulnerability/GHSA-c267-rfvc-mvpm · Vendor Advisory
• https://github.com/spring-projects/spring-ai · Note
• https://github.com/spring-projects/spring-ai/releases/tag/v1.0.4 · Note
• https://github.com/spring-projects/spring-ai/releases/tag/v1.1.3 · Note
• https://twitter.com/ptdbugs/status/2034182178158825863 · Twitter Post
• https://reddit.com/r/java/comments/1rxi6gx/spring_ai_cves_cve202622729_and_cve202622730_are · Reddit Post
• https://reddit.com/r/SpringBoot/comments/1s0skgk/psa_spring_ai_104_113_patches_two_injection_vulns · Reddit Post
• https://reddit.com/r/java/comments/1s0si5o/spring_ai_vector_store_has_two_high_injection · Reddit Post
• https://twitter.com/VulmonFeeds/status/2034211841124045288 · Twitter Post
• https://twitter.com/0dayPublishing/status/2034282235122127193 · Twitter Post
• https://twitter.com/zench4n/status/2037912359726100931 · Twitter Post
• https://twitter.com/ptdbugs/status/2035989958708580751 · Twitter Post