Paper/Archive/CVE-2026-59318

CVE-2026-59318

Spring Spring AI — DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection

EPSS 0.3%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 17.0.170 × 203.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation. Affected versions: Spring AI: 2.0.0 Spring AI: 1.1.0 through 1.1.8 Spring AI: 1.0.0 through 1.0.9

Affected

ProductAffectedFixed inSource

Spring AI2.0.0–CNA

Spring AI1.1.0 – 1.1.8–CNA

Spring AI1.0.0 – 1.0.9–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vmware (CNA)6.5CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refspring.io/security/cve-2026-59318