CVE-2026-59318 is a medium severity flaw (CVSS 6.5) in Spring AI tool calling. The per-request tool list is advertised to the model but not fully enforced at dispatch, so an unadvertised tool could be invoked. Upgrade to 2.0.1, or 1.1.9, 1.0.10 or 2.0.0.1 with enterprise support.
What's affected
- Spring AI 2.0.0.
- Spring AI 1.1.0 through 1.1.8.
- Spring AI 1.0.0 through 1.0.9.
- Fixed: 2.0.1 (open source). 2.0.0.1, 1.1.9 and 1.0.10 are enterprise support only.
How to check if you're exposed
Run mvn dependency:tree -Dincludes=org.springframework.ai or the Gradle equivalent and read the Spring AI version. Then list the tools your app registers globally and ask which would be dangerous if the model called them in a request that did not offer them.
To find this library in your own projects, paste a manifest or lockfile into the free in-browser dependency scan at gold.safeguard.sh/scan. Gold lists known CVEs for the packages it finds, and its reachability analysis helps you separate code that actually calls a vulnerable function from code that only ships it.
What to do now
- Upgrade Spring AI to a fixed version.
- Review globally registered tools and remove any with write or admin power that are not needed.
- Add authorization checks inside each sensitive tool rather than relying on the tool list.
- Log tool calls with the user and request that triggered them.
Once the new version is in, run the same dependency or version check again and keep the output with your change record. Lockfiles drift, and a rebuilt image can quietly pull the old version back in, so check the artifact you actually deploy and not only the source tree.
Why it matters
The record classes this as CWE-863 (Incorrect Authorization), and the Spring advisory title mentions a global resolver fallback and prompt injection. The tool list for a request is a boundary in the prompt, but at dispatch a tool outside that list could still be found and run.
The lesson reaches beyond Spring. A list sent to a model is advice to the model, not access control. Enforce permissions where the tool runs. The CISA KEV flag is false.
Tool calling lets a language model ask your application to run a function. Spring AI lets you supply a list of tools for each request. The advisory says that list is not fully enforced when a call arrives, so a tool outside it could still run in some conditions.
To judge your own exposure, list the tools registered in your application and mark each one by what it can change. A tool that reads public data is a small risk. A tool that sends email, edits records or calls an internal API with a service account is a larger one. Then ask whether any of these are registered globally, since those are the ones a request could reach without being offered.
The score is medium partly because the record needs a logged in user, user interaction and high attack complexity. That is not a reason to wait, because the fixed 2.0.1 release is the open source fix and the older lines have enterprise builds.
Try it yourself
Severity alone does not tell you what to fix first. This demo shows how exploitability context changes the order.
Click through it at your own pace, or open it full screen.
Quick check
Why does prompt injection matter here?
The advisory title says an unadvertised tool could be dispatched via prompt injection, so untrusted text could steer the model.
Sources
Last reviewed: 19 October 2026.
