{"id":"CVE-2026-59318","title":"In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched","summary":"In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","cwe":["CWE-863"],"vendor":"vmware","product":"spring_ai","affected":["spring_ai >= 1.0.0, < 1.0.10","spring_ai >= 1.1.0, < 1.1.9","spring_ai >= 2.0.0, < 2.0.1"],"patched":["spring_ai 2.0.1"],"published":"2026-08-21","updated":"2026-09-16","sourceUpdated":"2026-09-16T14:01:40.640","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59318","references":[{"url":"https://spring.io/security/cve-2026-59318","label":"security@vmware.com"}],"tags":["nvd"],"epss":0.00254,"epssPercentile":0.15124,"ingestedAt":"2026-09-16T14:57:28.004Z","slug":"CVE-2026-59318","body":"## Overview\n\nIn Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation.\nAffected versions:\nSpring AI: 2.0.0\nSpring AI: 1.1.0 through 1.1.8\nSpring AI: 1.0.0 through 1.0.9\n\n## Affected\n\n- `spring_ai >= 1.0.0, < 1.0.10`\n- `spring_ai >= 1.1.0, < 1.1.9`\n- `spring_ai >= 2.0.0, < 2.0.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `spring_ai 2.0.1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}