{"id":"CVE-2026-59318","aliases":["CLSA-2026-1793463667","CLSA-2026-1793654179","EUVD-2026-63933","GHSA-wmqr-wxf2-6449"],"status":"published","title":"DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection","description":"In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation.\nAffected versions:\nSpring AI: 2.0.0\nSpring AI: 1.1.0 through 1.1.8\nSpring AI: 1.0.0 through 1.0.9","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00254,"percentile":0.17103,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-08-21T12:07:10Z","modified":"2026-11-03T02:45:02Z","affected":[{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.9-tuxcare.1"}]}],"versions":["1.0.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-pdf-document-reader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.9-tuxcare.1"}]}],"versions":["1.0.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-transformers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.9"},{"fixed":"1.0.9-tuxcare.1"}]}],"versions":["1.0.9"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-model","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8"},{"fixed":"1.1.8-tuxcare.1"}]}],"versions":["1.1.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-pdf-document-reader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8"},{"fixed":"1.1.8-tuxcare.1"}]}],"versions":["1.1.8"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.springframework.ai:spring-ai-transformers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.1.8"},{"fixed":"1.1.8-tuxcare.1"}]}],"versions":["1.1.8"],"bundled":4}],"products":[{"vendor":"spring","product":"spring ai"},{"vendor":"vmware","product":"spring ai"},{"vendor":"vmware","product":"spring_ai"}],"references":[{"url":"https://spring.io/security/cve-2026-59318","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59318","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wmqr-wxf2-6449"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59318.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59318","title":"DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection","description":"In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation.\nAffected versions:\nSpring AI: 2.0.0\nSpring AI: 1.1.0 through 1.1.8\nSpring AI: 1.0.0 through 1.0.9","status":"published","published":"2026-08-21T12:07:10.349Z","modified":"2026-08-22T03:55:38.874Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-63933","description":"In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation.\nAffected versions:\nSpring AI: 2.0.0\nSpring AI: 1.1.0 through 1.1.8\nSpring AI: 1.0.0 through 1.0.9","status":"published","published":"2026-08-21T12:07:10Z","modified":"2026-08-22T03:55:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:36.154425Z"}],"ghsa":[{"id":"GHSA-wmqr-wxf2-6449","title":"In Spring AI's tool calling support, the per-request tool list is advertised to the model as a...","description":"In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation.\nAffected versions:\nSpring AI: 2.0.0\nSpring AI: 1.1.0 through 1.1.8\nSpring AI: 1.0.0 through 1.0.9","status":"published","published":"2026-08-21T12:30:34Z","modified":"2026-08-21T12:30:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:10:49.498684Z"}],"nvd":[{"id":"CVE-2026-59318","description":"In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation.\nAffected versions:\nSpring AI: 2.0.0\nSpring AI: 1.1.0 through 1.1.8\nSpring AI: 1.0.0 through 1.0.9","status":"published","published":"2026-08-21T12:16:30.39Z","modified":"2026-10-15T19:10:00.173Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-59318","title":"DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection","description":"In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation.\nAffected versions:\nSpring AI: 2.0.0\nSpring AI: 1.1.0 through 1.1.8\nSpring AI: 1.0.0 through 1.0.9","status":"published","published":"2026-08-21T12:07:10.349Z","modified":"2026-10-28T02:30:43.959320091Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"CLSA-2026-1793463667","title":"TuxCare security update for org.springframework.ai (4 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ai packages to address 4 CVEs. Fixed in 1.0.9-tuxcare.1.","status":"published","published":"2026-10-31T17:21:08Z","modified":"2026-11-02T19:46:33.281908979Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793654179","title":"TuxCare security update for org.springframework.ai (4 CVEs)","description":"TuxCare rebuilt 3 org.springframework.ai packages to address 4 CVEs. Fixed in 1.1.8-tuxcare.1.","status":"published","published":"2026-11-02T22:16:19Z","modified":"2026-11-03T02:45:02.358314545Z","updated_at":"2026-11-03T03:05:43.703218Z"}]}}