Cyber Centre Daily Advisory Digest — 2026-03-17 (2 advisories)
The Canadian Centre for Cyber Security released a daily digest highlighting critical vulnerabilities in Spring AI, including SQL and JSONPath injections, as well as unspecified vulnerabilities in GitHub Enterprise Server. Organizations utilizing these products are advised to apply the latest security patches to mitigate potential exploitation risks.
Key Takeaways
- Spring AI is vulnerable to SQL Injection (CVE-2026-22730) and JSONPath Injection (CVE-2026-22729) in versions prior to 1.0.4 and 1.1.3.
- GitHub Enterprise Server has multiple vulnerabilities addressed in recent patches across the 3.16.x to 3.19.x branches.
- Administrators are strongly encouraged to apply the necessary vendor updates immediately to mitigate exploitation risks.
Affected Systems
- Spring AI 1.0.x prior to 1.0.4
- Spring AI 1.1.x prior to 1.1.3
- GitHub Enterprise Server 3.19.x prior to 3.19.4
- GitHub Enterprise Server 3.18.x prior to 3.18.7
- GitHub Enterprise Server 3.17.x prior to 3.17.13
- GitHub Enterprise Server 3.16.x prior to 3.16.16
Vulnerabilities (CVEs)
- CVE-2026-22730
- CVE-2026-22729
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the advisory.
Detection Engineering Assessment
EDR Visibility: Low — EDR typically does not have deep visibility into application-level SQL or JSONPath injections without specific web server integrations or post-exploitation activity. Network Visibility: Medium — WAFs and network IDS/IPS may detect SQL injection or JSONPath injection payloads in transit if SSL/TLS inspection is enabled. Detection Difficulty: Moderate — Detecting specific exploitation requires application-layer logging and WAF rules tuned for SQLi and JSONPath injection targeting Spring AI endpoints.
Required Log Sources
- Web Application Firewall (WAF) logs
- Application audit logs
- Database query logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Search WAF and web access logs for anomalous SQL syntax or JSONPath expressions targeting Spring AI endpoints. | WAF logs, Web server access logs | Initial Access | Medium |
Control Gaps
- Lack of WAF inspection on internal API traffic
- Insufficient database query logging
Key Behavioral Indicators
- Unexpected SQL syntax in web requests
- Anomalous JSONPath queries in API payloads
False Positive Assessment
- Low
Recommendations
Immediate Mitigation
- Update Spring AI to versions 1.0.4 or 1.1.3.
- Update GitHub Enterprise Server to versions 3.19.4, 3.18.7, 3.17.13, or 3.16.16.
Infrastructure Hardening
- Ensure Web Application Firewall (WAF) rules are updated to detect SQL injection and JSONPath injection attempts.
User Protection
- N/A
Security Awareness
- Monitor vendor security advisories for Spring and GitHub to stay informed of emerging vulnerabilities.
MITRE ATT&CK Mapping
- T1190 - Exploit Public-Facing Application
