CVE-2026-59318: Incorrect Authorization in Spring Spring AI

In Spring AI's tool calling feature, the per-request tool list is intended to restrict which tools the model can invoke. However, this boundary is not fully enforced during tool call dispatch. As a result, under certain conditions, a tool not authorized for the current request can be invoked. This incorrect authorization can lead to privilege escalation. The vulnerability affects Spring AI versions 1.0.0 through 1.0.9, 1.1.0 through 1.1.8, and 2.0.0. The CVSS 3.1 score is 6.5 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, user interaction required, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

An attacker able to trigger tool calls in Spring AI could invoke tools not authorized for the current request. This can lead to privilege escalation, potentially exposing sensitive information or allowing unauthorized actions. The confidentiality impact is high, while integrity impact is low and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should review and restrict tool call permissions carefully and monitor for unusual tool invocation behavior.