CVE-2026-59318: DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection
In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation. Affected versions: Spring AI: 2.0.0 Spring AI: 1.1.0 through 1.1.8 Spring AI: 1.0.0 through 1.0.9
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Spring AI tool calling support in versions 2.0.0, 1.1.0 through 1.1.8, or 1.0.0 through 1.0.9 are affected when their tool-dispatch conditions allow a tool outside the per-request advertised list to be resolved.
What would an attacker need to exploit it?
An attacker needs network access, low privileges, and user interaction, according to the supplied CVSS vector. Exploitation also has high attack complexity and relies on prompt injection to cause dispatch of an unadvertised tool.
What is the potential impact?
A successful exploit could invoke a tool that was not available to the current request, potentially enabling privilege escalation. The reported impact includes high confidentiality impact and low integrity impact, with no availability impact.