Spring Ai CVE-2026-22730

Requires authenticated user access to Spring AI applications using MariaDBFilterExpressionConverter for metadata filtering. Attacker must have PR:L privileges to inject malicious SQL through filter expressions. No victim interaction needed. Affects default Spring AI deployments with MariaDB backend.

This vulnerability presents significant real-world risk due to multiple converging factors from the CVSS vector analysis. The attack vector is network-based (AV:N) with low complexity (AC:L), requiring only low privileges (PR:L) and no user interaction (UI:N), making it highly accessible to authenticated attackers. The impact is severe across all CIA triad dimensions (C:H/I:H/A:H), enabling complete database compromise. While EPSS probability data is not provided in the intelligence, the combination of low attack complexity, network accessibility, and critical impact typically correlates with elevated exploitation likelihood. No KEV listing is mentioned, suggesting no confirmed active exploitation in the wild yet, and no public POC is explicitly referenced. However, SQL injection vulnerabilities are well-understood and easily exploitable once discovered, making this automatable and likely to be weaponized rapidly. The SSVC framework would likely classify this as requiring urgent remediation due to the technical impact (total system compromise possible), low exploitation barrier, and broad attack surface in internet-facing Java applications using Spring AI with MariaDB backends.

An authenticated attacker with low-level credentials to a Spring AI application crafts a malicious metadata filter expression containing SQL injection payloads when querying the MariaDB vector database. Because the MariaDBFilterExpressionConverter fails to sanitize this input, the attacker's injected SQL commands execute with the privileges of the application's database user, allowing them to bypass intended access controls, extract sensitive data from other users' records, modify or delete database contents, or potentially escalate to operating system command execution depending on database configuration. Given the network-accessible attack vector and low complexity, this can be performed remotely without user interaction once the attacker has obtained valid application credentials.