CVE-2026-22730: 
Java vulnerability analysis and mitigation

CVE-2026-22730 is a SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter component that allows authenticated attackers to bypass metadata-based access controls and execute arbitrary SQL commands. It affects VMware Spring AI versions 1.0.0–1.0.x (fixed in 1.0.4) and 1.1.0–1.1.x (fixed in 1.1.3). The vulnerability was disclosed on March 17–18, 2026, and was responsibly reported by the Blackf0g team from SecureLayer7. It carries a CVSS v3.1 base score of 8.8 (High) (Spring Advisory, Feedly).

The root cause is missing input sanitization in the MariaDBFilterExpressionConverter class (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). When Spring AI constructs SQL filter expressions for MariaDB-backed vector store queries, user-supplied metadata filter values are passed directly into SQL statements without parameterization or escaping, enabling injection of arbitrary SQL syntax. Exploitation requires network access and low-level authenticated privileges (PR:L), with no user interaction needed. A public Python-based exploit scanner has been released that demonstrates both time-based blind SQL injection (via SLEEP() payloads) and destructive operations including data retrieval (SELECT injection) and deletion (DELETE injection) (Spring Advisory, PoC Scanner, SecureLayer7 Blog).

Successful exploitation allows an authenticated attacker with low privileges to read, modify, or delete sensitive data stored in the MariaDB vector store database, resulting in high confidentiality, integrity, and availability impact. Attackers can bypass metadata-based access controls, potentially exposing AI-indexed documents or embeddings that should be restricted to other users or tenants. In worst-case scenarios, destructive SQL injection (e.g., DELETE statements) could wipe vector store contents, disrupting AI application functionality (Spring Advisory, Feedly).

1. Reconnaissance: Identify applications using Spring AI with a MariaDB vector store backend. Check dependency manifests (e.g., pom.xml, build.gradle) for spring-ai versions between 1.0.0–1.0.3 or 1.1.0–1.1.2.
2. Authentication: Obtain low-privilege credentials to the target application (e.g., a standard user account), as the vulnerability requires PR:L.
3. Identify injection point: Locate API endpoints that accept metadata filter expressions passed to the MariaDB vector store (e.g., similarity search endpoints with filter parameters).
4. Probe with time-based injection: Send a crafted request with a SLEEP()-based SQL payload in the filter expression field (e.g., ' OR SLEEP(5)-- -) to confirm blind SQL injection via response delay.
5. Extract data: Use SELECT-based injection payloads to retrieve documents, embeddings, or other sensitive data from the vector store database.
6. Destructive action (optional): With explicit confirmation, inject DELETE-based payloads to wipe vector store contents, disrupting AI application functionality.
7. Automate: Use the public Python scanner (cve-2026-22730_scanner.py --url <target>) to automate detection and exploitation steps against target systems (PoC Scanner, SecureLayer7 Blog).

• Network: Unusual HTTP requests to Spring AI vector store search/query endpoints containing SQL metacharacters (e.g., single quotes ', --, SLEEP(, UNION SELECT, DELETE FROM) in filter or metadata parameters.
• Logs: Application logs showing SQL errors or unexpected query structures originating from filter expression conversion; MariaDB general query logs containing injected SQL fragments such as SLEEP(), UNION, or DELETE statements not matching expected application queries.
• Database: Unexpected SELECT queries returning large result sets from vector store tables; DELETE operations on vector store tables not initiated by application administrators; sudden loss of vector store data.
• Application: Anomalous response times on vector store query endpoints (indicative of time-based blind injection); increased error rates from the MariaDBFilterExpressionConverter component in application logs (PoC Scanner, SecureLayer7 Blog).

Upgrade Spring AI to the patched versions: 1.0.4 (for the 1.0.x line) or 1.1.3 (for the 1.1.x line). The Spring advisory states no additional mitigation steps are necessary beyond upgrading. As interim measures, consider deploying WAF rules to detect and block SQL injection patterns in API requests, restricting database credentials to the minimum necessary privileges, and reviewing MariaDB query logs for signs of exploitation (Spring Advisory, Feedly).

The vulnerability was responsibly disclosed by the Blackf0g team at SecureLayer7, who published a detailed technical blog post and issued a press release disclosing two high-severity injection vulnerabilities in Spring AI (CVE-2026-22730 and the related CVE-2026-22729) (SecureLayer7 Blog). The Canadian Centre for Cyber Security (CCCS) issued an advisory (AV26-245), and Spain's INCIBE-CERT and CCN-CERT also published alerts. Community discussion appeared on Reddit's r/java, r/netsec, r/blueteamsec, and r/SpringBoot, with developers noting the importance of patching AI framework dependencies. HeroDevs published a blog contextualizing the CVEs within the broader Spring Boot 3.5 EOL landscape (HeroDevs Blog).