CVE-2026-59318

Overview

Spring AI is the Spring project for building AI-powered applications on the JVM. It provides portable abstractions over chat models, embedding models, and vector stores, and it ships the tool calling support that lets a model invoke application-defined Java methods, together with Spring Boot auto-configuration that wires those abstractions into an application context.

An Authorization Bypass vulnerability (CVE-2026-59318) has been identified in the tool calling support of Spring AI, which allows attackers to have a tool that was never advertised to the current request executed by steering the model into naming it, reaching capabilities the request was not granted.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user’s limits.

This issue affects the tool calling support of Spring AI.

‍

Details

Module Info

• Product: Spring AI
• Affected packages: org.springframework.ai:spring-ai-model
• Affected versions: >=1.0.0 <=1.0.9, >=1.1.0 <=1.1.8, 2.0.0
• GitHub repository: https://github.com/spring-projects/spring-ai
• Published packages: https://central.sonatype.com/artifact/org.springframework.ai/spring-ai-model
• Package manager: Maven
• Fixed in:
• NES for Spring AI: the nes-1.0.x and nes-1.1.x lines
• OSS Spring AI 2.0.1

Vulnerability Info

This Medium-severity vulnerability is found in the org.springframework.ai:spring-ai-model package in the tool calling support of Spring AI.

Each chat request carries its own list of tool callbacks, and only those callbacks are described to the model as the tools it is allowed to call. When the model answers with a tool call, DefaultToolCallingManager looks the requested name up in that per-request list, but when the name is missing it falls back to the application-wide ToolCallbackResolver, which can see every tool registered in the Spring context:

String toolName = toolCall.name();

ToolCallback toolCallback = toolCallbacks.stream()
    .filter(tool -> toolName.equals(tool.getToolDefinition().name()))
    .findFirst()
    .orElseGet(() -> this.toolCallbackResolver.resolve(toolName));

if (toolCallback == null) {
    logger.warn(POSSIBLE_LLM_TOOL_NAME_CHANGE_WARNING, toolName);
    throw new IllegalStateException("No ToolCallback found for tool name: " + toolName);
}

Whatever the fallback returns is then executed with the arguments the model supplied, without any further check that the tool belonged to the request:

toolResult = toolCallback.call(finalToolInputArguments, toolContext);

The tool name is attacker-influenced data. It is produced by the model, and the model’s output can be steered by untrusted content that reaches the prompt, such as a user message, a retrieved document, or the result of an earlier tool call. Because the fallback is unconditional, the per-request tool list bounds only what the model is told about, not what it is able to run. An attacker who knows or guesses the name of a tool registered elsewhere in the application, for example an administrative callback deliberately kept out of this request, can cause that callback to run with arguments of their choosing, so a low-privileged conversation reaches capabilities that were meant to be reserved for another flow.

This vulnerability was introduced in 2025 with Spring AI 1.0.0-M6.

‍

Mitigation

Only recent versions of Spring AI receive community support. Older lines are End-of-Life and will not receive public updates to address this issue.

Users of the affected components should apply one of the following mitigations:

• Upgrade to a currently supported version of Spring AI.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

‍

Credits

• Arjun Basnet from Securin (finder)
• ChangMin Lee (finder)