CVE-2026-59318
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9 have a vulnerability in tool calling support where the per-request tool list is not fully enforced. Under certain conditions, a tool not made available to the current request could be invoked, potentially leading to privilege escalation.
Risk Assessment
Privilege escalation, potentially allowing an attacker to perform unauthorized operations in the application.
Recommendation
Upgrade Spring AI to a version that includes the fix (e.g., 2.0.1 or later if available).
Other vulnerabilities in Spring AI
See all- CVE-2026-59319Medium
RedisChatMemoryRepository.findByMetadata() builds RediSearch tag and text queries from caller-supplied metadata values without applying RediSearchUtil.escape(), unlike get(), clear(), and findByTimeRange() in the same class which do escape their inputs. An application that passes user-controlled values to findByMetadata() on a tag-typed metadata field allows an attacker to inject RediSearch syntax (e.g. x} | *) that breaks out of the tag clause and matches all indexed chat messages across every conversation in the index. Affects Spring AI 2.0.0.
- CVE-2026-59294Medium
ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.9 and earlier.
- CVE-2026-47852High
A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9.
- CVE-2026-47851High
Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread. Affects Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9.
- CVE-2026-59308Medium
In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI 2.0.0.
- CVE-2026-59279High
The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not limit the number of sessions it retains and by default does not require client authentication. A remote attacker can cause unbounded session accumulation, gradually exhausting memory and leading to Denial of Service (DoS) for all legitimate clients. Affects Spring AI version 2.0.0.
- CVE-2026-41863Medium
In Spring AI versions 1.1.0 through 1.1.x, support for Anthropic's Skills API uses LLM-influenced filenames unsanitized in Path.resolve before writing files to disk. This could allow a malicious user to write files outside the intended target directory, including restricted directories.
- CVE-2026-41705High
Vulnerability in Spring AI's MilvusVectorStore#doDelete(List) implementation allows filter-expression injection via unsanitized document IDs. Affects Spring AI 1.0.x (up to 1.0.7) and 1.1.x (up to 1.1.6).
Original NVD description (English source)
In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation. Affected versions: Spring AI: 2.0.0 Spring AI: 1.1.0 through 1.1.8 Spring AI: 1.0.0 through 1.0.9