CVE-2026-59318: Spring AI Privilege Escalation Vulnerability

CVE-2026-59318 Overview

CVE-2026-59318 affects Spring AI's tool calling support. The per-request tool list is advertised to the model as an authorization boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request can still be invoked. This authorization flaw [CWE-863] can lead to privilege escalation within applications that rely on the per-request tool scoping mechanism to isolate capabilities between users, sessions, or contexts.

Critical Impact
An attacker able to influence model output can invoke tools outside the advertised per-request boundary, potentially escalating privileges within the host application.

Affected Products

Spring AI 2.0.0
Spring AI 1.1.0 through 1.1.8
Spring AI 1.0.0 through 1.0.9

Discovery Timeline

2026-08-21 - CVE-2026-59318 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-59318

Vulnerability Analysis

Spring AI provides a tool calling abstraction that lets applications expose functions as callable tools to large language models (LLMs). Applications typically pass a per-request tool list to define which tools the model may invoke for a given interaction. This list acts as an authorization boundary between different users, tenants, or session contexts.

The vulnerability stems from incomplete enforcement of that boundary at dispatch time. The per-request list is transmitted to the model as available options, but when a tool call comes back from the model, Spring AI does not consistently verify that the requested tool belongs to the current request scope. A tool registered elsewhere in the application context can be dispatched even when it was not offered for the current request.

This is a classic incorrect authorization pattern [CWE-863]. The application communicates a policy to the model but relies on the model to honor it rather than enforcing the policy at the trust boundary. User interaction is required because a crafted or manipulated prompt must cause the model to emit a tool call referencing an out-of-scope tool.

Root Cause

The root cause is a missing authorization check in the tool dispatch path. Spring AI resolves tool names against a broader registry rather than restricting resolution to the tools advertised for the specific request. The advertised boundary becomes advisory instead of enforced.

Attack Vector

Exploitation requires network access to the Spring AI-backed application and requires the attacker to influence the prompt or conversation flow. Techniques such as prompt injection through untrusted content, tool result poisoning, or crafted user input can steer the model into emitting a tool call for a tool that was not exposed for the current request. If that tool exists elsewhere in the application registry, Spring AI dispatches it, and the attacker gains access to functionality outside their intended scope.

No verified public exploit code is available. See the Spring Security Advisory CVE-2026-59318 for authoritative technical details.

Detection Methods for CVE-2026-59318

Indicators of Compromise

Tool invocation log entries where the dispatched tool name is not present in the per-request tool list sent to the model.
Unexpected tool calls issued in sessions belonging to low-privilege users or tenants that reference administrative or cross-tenant tools.
Prompt content containing tool-name strings or JSON tool-call fragments injected through untrusted input channels.

Detection Strategies

Instrument the Spring AI tool dispatch layer to log both the advertised tool list and the tool actually invoked for every request, then alert on mismatches.
Correlate LLM request/response pairs with downstream tool execution events to identify out-of-scope dispatches.
Run application-level tests that submit prompt-injection payloads referencing tools outside the current request scope and verify they are rejected.

Monitoring Recommendations

Ingest Spring AI application logs into a centralized analytics platform and build dashboards for tool invocation patterns per user, tenant, and endpoint.
Monitor for spikes in tool-call errors, denied calls, or unusual tool-name strings appearing in model output.
Track upstream prompt sources for injection indicators when those sources feed tool-enabled Spring AI flows.

How to Mitigate CVE-2026-59318

Immediate Actions Required

Inventory all applications using Spring AI 1.0.x, 1.1.x, or 2.0.0 and identify those that rely on per-request tool lists as an authorization boundary.
Upgrade Spring AI to a fixed version as identified in the Spring Security Advisory CVE-2026-59318.
Add an application-side authorization check inside each tool implementation that revalidates whether the current principal is permitted to invoke that tool.

Patch Information

Spring has published a security advisory for CVE-2026-59318 with fixed version guidance. Consult the Spring Security Advisory CVE-2026-59318 for the specific patched releases in the 1.0.x, 1.1.x, and 2.0.x branches, and upgrade affected applications accordingly.

Workarounds

Enforce authorization inside every tool callback by checking the current user, tenant, and session context before executing sensitive logic.
Reduce the global tool registry so that tools intended for administrative or cross-tenant use are not co-registered with user-facing tools in the same application context.
Sanitize and constrain untrusted content fed into prompts, and strip or escape any tool-call syntax originating from user or third-party input.
Deploy separate Spring AI application instances or contexts for privilege tiers so that sensitive tools are not reachable from lower-privilege request paths.

bash

# Configuration example
# See the Spring Security Advisory for the exact fixed versions.
# Update Maven dependency to a patched Spring AI release:
# <dependency>
#   <groupId>org.springframework.ai</groupId>
#   <artifactId>spring-ai-core</artifactId>
#   <version>PATCHED_VERSION</version>
# </dependency>