Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-17 | 3 | Disclosure2Patch1 |
| 2026-03-18 | 7 | Disclosure5General2 |
| 2026-03-19 | 6 | Disclosure5General1 |
| 2026-03-23 | 2 | Patch1PoC1 |
| 2026-03-27 | 1 | General1 |
| 2026-03-28 | 3 | General3 |
| 2026-04-10 | 1 | General1 |
CVE-2026-22730: SQL Injection in Spring AI’s MariaDB Vector Store https://blog.securelayer7.net/cve-2026-22730-sql-injection-spring-ai-mariadb/
Post summary
The tweet announces CVE‑2026‑22730, an SQL Injection flaw in Spring AI’s MariaDB Vector Store, and links to a blog post that presumably contains further details.
CVE-2026-22730: SQL Injection in Spring AI’s MariaDB Vector Store https://blog.securelayer7.net/cve-2026-22730-sql-injection-spring-ai-mariadb/
Post summary
The post announces CVE‑2026‑22730, a SQL injection vulnerability affecting Spring AI’s MariaDB Vector Store, linking to a blog article for more details.
Two critical flaws in Spring AI (CVE-2026-22729 & CVE-2026-22730) allow attackers to bypass access controls via JSONPath and SQL injection. Update now. #SpringAI #CVE #CyberSecurity #InfoSec #SQLInjection #JavaSecurity #Vulnerability #AppSec #TechNews https://securityonline.info/critical-spring-ai-vulnerabilities-sql-jsonpath-injection-cve-2026-22730/ https://t.co/KU01zxmHHi
Post summary
Two critical Spring AI flaws (CVE‑2026‑22729 and CVE‑2026‑22730) allow bypass of access controls through JSONPath and SQL injection; the text stresses that users should update immediately to mitigate the risk.
🔔 A PoC/exploit has been discovered for vulnerability CVE-2026-22730 Vendor: VMware Product: Spring AI Description: A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization. Link: https://github.com/NULL200OK/CVE-2026-22730-Scanner #dbugs_vuln
Post summary
A proof‑of‑concept and exploit scanner for CVE‑2026‑22730, a critical SQL injection in VMware Spring AI, has been released, but no active exploitation or patch information is currently available.
『The deeper reason it went unnoticed: the SQL in `MariaDBVectorStore .java` does use `?` placeholders — for the embedding vector and distance threshold.』 CVE-2026-22730: SQL Injection in Spring AI’s MariaDB Vector Store https://blog.securelayer7.net/cve-2026-22730-sql-injection-spring-ai-mariadb/
Post summary
The blog post announces a SQL Injection vulnerability (CVE‑2026‑22730) in Spring AI’s MariaDB Vector Store, detailing how the query uses placeholders but providing no PoC, exploit code, or patch information.
Spring AI users: CVE-2026-22729 (JSONPath Injection) and CVE-2026-22730 (SQL Injection) highlight that even "safe" frameworks need runtime monitoring. 🛡️ Don't trust inputs blindly. Secure your agentic workflows with MCP Guard. #MCPSecurity #SpringAI #AISecurity
Post summary
The message references two newly identified CVEs in Spring AI (JSONPath and SQL injection) and advises caution, but provides no additional technical details, exploits, or mitigation guidance.
Consider the implications of CVE-2026-22730 in Spring AI. A SQLi in a vector store directly impacts an agent's knowledge base. A deep dive asks: how does this compromise affect agent autonomy, data integrity, and downstream decisions? Beyond the immediate exploit.
Post summary
The post mentions a SQL injection (CVE-2026-22730) in Spring AI’s vector store but offers no details on exploitation, patches, or PoC, merely raising high-level concerns about its impact on agent autonomy and data integrity.
Java Spring AIにSQLインジェクションとJSONPathインジェクションの脆弱性(CVE-2026-22730、CVE-2026-22729) https://rocket-boys.co.jp/security-measures-lab/spring-ai-sql-injection-jsonpath-injection-cve-2026-22730-cve-2026-22729/ #セキュリティ対策Lab #セキュリティ #Security #CybersecurityNews
Post summary
The post announces new SQL injection and JSONPath injection vulnerabilities in Java Spring AI (CVE-2026-22730 & CVE-2026-22729).
🟠 CVE-2026-22730 - High A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulne... https://www.thehackerwire.com/vulnerability/CVE-2026-22730/ https://t.co/XXtIaExcH8
Post summary
The post announces a critical SQL injection in Spring AI’s MariaDBFilterExpressionConverter that permits bypassing access controls to run arbitrary SQL, but it provides no PoC, exploit, or patch details.
CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter CVE: CVE-2026-22730 PT-Identifier: PT-2026-25940 Vendor: Vmware Product: Spring AI CVSS: 8.8 Credits: n/a Description: A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-22730 • https://spring.io/security/cve-2026-22730 #dbugs_vuln
Post summary
The announcement details CVE‑2026‑22730 as a critical SQL injection flaw in Spring AI’s MariaDBFilterExpressionConverter, noting missing input sanitization and a CVSS score of 8.8.
It's about anticipating emergent behaviors and adversarial prompting, not just patching known flaws. The `CVE-2026-22730` scanner for Spring AI is a step, but the agent's reasoning process is the next frontier.
Post summary
The text merely references CVE‑2026‑22730 as part of a scanner for Spring AI, without offering any technical, exploit, patch, or exploitation details.
Tools like RTOSploit (Indspl0it/RTOSploit) are gaining traction, reflecting increased focus on embedded security. Meanwhile, CVE-2026-22730-Scanner points to persistent SQLi risks in AI frameworks like Spring AI. Stay vigilant.
Post summary
The text points out general cybersecurity trends and mentions an SQLi vulnerability in a Spring AI framework, but lacks specific exploitation, patch, or PoC details.
Tools like RTOSploit (Indspl0it/RTOSploit) are gaining traction, reflecting increased focus on embedded security. Meanwhile, CVE-2026-22730-Scanner points to persistent SQLi risks in AI frameworks like Spring AI. Stay vigilant.
Post summary
The post highlights the growing use of RTOSploit and a scanner pointing to persistent SQL injection risks in AI frameworks, but provides no evidence of active exploitation or mitigation efforts.
Spring AI just got hit with 2 critical CVEs (CVE-2026-22729, CVE-2026-22730). Injection flaws in filter expressions can bypass metadata-based access control in vector stores meaning cross-tenant data exposure. If you’re using spring-ai-vector-store or mariadb-store with user filters, you’re at risk. 👉 Upgrade immediately: 1.0.4 / 1.1.3 #AI #SpringBoot #CyberSecurity #RAG #LLM #DevSecOps
Post summary
Spring AI disclosed two critical injection‑based CVEs that allow cross‑tenant data exposure, and it urges users to update to version 1.0.4 or 1.1.3 to remediate.
⚠️ Vulnerabilidad en productos Spring ❗ CVE-2026-22730 ➡️ Más info: https://www.cert.gov.py/vulnerabilidad-en-productos-spring-2/ https://t.co/s9i6z6j3yd
Post summary
The tweet lists CVE‑2026‑22730 affecting Spring products and links to external sources for more information, but provides no further details.
CVE-2026-22730: SQL Injection in Spring AI’s MariaDB Vector Store https://blog.securelayer7.net/cve-2026-22730-sql-injection-spring-ai-mariadb/ https://t.co/u8SOGbOtLB
Post summary
The tweet announces a new SQL injection vulnerability (CVE‑2026‑22730) in Spring AI’s MariaDB Vector Store and directs readers to a blog for more details.
CVE-2026-22730 A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary… https://www.cve.org/CVERecord?id=CVE-2026-22730
Post summary
The post announces a critical SQL injection flaw in Spring AI's MariaDBFilterExpressionConverter that lets attackers bypass metadata controls and run arbitrary code; no PoC, exploit, or patch details are provided.
⚠️ CVE-2026-22730: CVE... MariaDB filter bypass in Spring AI's metadata controls = instant database takeover with low-priv creds, CVSS 8.8 screams patch now #SQLi #SpringAI. https://zerodaysignal.com/vulnerability/CVE-2026-22730 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE‑2026‑22730 describes a MariaDB filter bypass that can lead to database takeover with low‑privilege credentials; it is presented as a newly disclosed vulnerability (SQLi, CVSS 8.8) with an urgent call for patching.
CVE-2026-22730 SQL Injection in Spring AI MariaDBFilterExpressionConverter Bypassing Access Controls https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22730
Post summary
CVE-2026-22730 is a SQL Injection in Spring AI’s MariaDBFilterExpressionConverter that can bypass access controls; no evidence of exploitation, PoC, or patches is provided.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-22730 - CVE-2026-22730: SQL Injection in Spring AI MariaDBFilterExpressionConverter Intel Report: https://ift.tt/GBF4zdU
Post summary
The notice identifies CVE-2026-22730 as a SQL‑injection flaw in the Spring AI MariaDBFilterExpressionConverter, citing an Intel report for more details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vmware | spring_ai | - | - | - |