A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands.
The vulnerability exists due to missing input sanitization.
References
| Link | Resource |
|---|---|
| https://spring.io/security/cve-2026-22730 |
Configurations
No configuration.
History
18 Mar 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-89 |
18 Mar 2026, 08:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-03-18 08:16
Updated : 2026-03-18 16:16
NVD link : CVE-2026-22730
Mitre link : CVE-2026-22730
CVE.ORG link : CVE-2026-22730
JSON object : View
Products Affected
No product.
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')