CVE-2026-22730·MariaDB vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 6% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-22730 scores 8.8 on CVSS, so a successful attack would be serious — but at <0.1%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

How to fix this CVE

Update MariaDB to version 1.1.3 or later to patch the SQL injection vulnerability in the Spring AI filter expression converter. This fix removes the missing input sanitization that allowed authenticated users to bypass access controls and execute arbitrary SQL commands. Apply the update immediately, especially in environments where Spring AI is integrated with MariaDB for vector search or AI-driven features.

sudo dnf update mariadb-server

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

SQL injection payloads in MariaDB query logs containing metadata filter expressions with embedded UNION SELECT, time-based delays (SLEEP/BENCHMARK), or boolean-based conditions; example pattern: `UNION.*SELECT|BENCHMARK\(.*,.*\)|AND.*=.*--` in authenticated query logs

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

If MariaDB is exposed through a web application layer, implement WAF rules to reject API requests containing SQL metacharacters (UNION, SELECT, --, /*, ;) in filter parameters; additionally, enforce strict input validation on all metadata-driven query endpoints and use parameterized queries exclusively.

How to check if you are affected

1. Run `mariadb --version` or `SELECT VERSION();` in the MariaDB client to confirm the installed version. Vulnerable versions range from 1.1.0 to 1.1.2.
2. Check if Spring AI is installed and configured with MariaDB by searching for Spring AI dependencies in your application's pom.xml or build.gradle: `grep -r 'spring-ai' /path/to/app`
3. Search MariaDB query logs for suspicious SQL patterns combining filter expressions with UNION, subqueries, or comment sequences (-- or /* */) in authenticated sessions: `grep -i 'UNION\|--\|/\*' /var/log/mysql/mysql.log`
4. After updating, verify the fix by running `mariadb --version` again and confirming the version is 1.1.3 or later, then restart the MariaDB service: `sudo systemctl restart mariadb`

FAQ

Related MariaDB CVEs

References

• https://spring.io/security/cve-2026-22730