Spring AI 1.x/2.0.0 Privilege Escalation: Unrestricted Tool Call (AI)
CVE-2026-59318 Published on August 21, 2026
DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection
In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation.
Affected versions:
Spring AI: 2.0.0
Spring AI: 1.1.0 through 1.1.8
Spring AI: 1.0.0 through 1.0.9
Vulnerability Analysis
CVE-2026-59318 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-59318 has been classified to as an AuthZ vulnerability or weakness.
Affected Versions
Spring AI:- Version 2.0.0 is affected.
- Version 1.1.0, <= 1.1.8 is affected.
- Version 1.0.0, <= 1.0.9 is affected.