The vulnerability in Spring AI involves incorrect authorization in the tool calling mechanism. Although the per-request tool list is advertised as a boundary to the model, enforcement is incomplete when dispatching tool calls. This can result in unauthorized tools being invoked beyond the intended scope of the request, which may lead to privilege escalation. The affected versions explicitly include 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and 2.0.0. The CVSS 3.1 score is 6.5, indicating medium severity with network attack vector, high attack complexity, low privileges required, and user interaction needed. Confidentiality impact is high, integrity impact is low, and availability is not affected. No vendor advisory or patch information is currently available.

Exploitation of this vulnerability could allow an attacker with limited privileges and requiring user interaction to invoke unauthorized tools within Spring AI, potentially escalating their privileges. The confidentiality of the system could be significantly impacted, while integrity impact is low and availability is unaffected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when deploying affected versions and consider restricting access to trusted users only. Monitor vendor communications for updates on patches or official mitigations.