External risk intelligence

Spring AI Tool Calling Privilege Escalation Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-59318

Spring AI is a framework used to build AI-powered applications, which are commonly deployed as internet-facing web services or APIs. Because the vulnerability exists within the request processing and tool calling logic of these applications, the attack surface is typically exposed to the public network where users interact with the AI interface.

Privilege Escalation

Vmware Spring Ai

1.0.0 to before 1.0.101.1.0 to before 1.1.92.0.0 to before 2.0.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Spring AI's tool calling feature could allow unauthorized invocation of functions, potentially leading to unauthorized access and control over systems. This issue arises because the list of available tools for a given request is not consistently enforced, creating a pathway for unexpected actions. The main concern is confirming relevance and exposure to this type of AI integration.

Unauthorized functions may be called.
Protects against potential system access.
Confirm AI integration exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests to an application using a vulnerable version of Spring AI. The application's tool calling feature, which allows AI models to interact with external tools, has a flaw where it doesn't fully validate the tools allowed for a specific request. This could enable an attacker to trick the system into invoking tools that were not intended for that request, potentially leading to unauthorized actions.

Network access required.
Triggered by tool dispatch flaws.
Unauthorized tool execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to invoke unintended tools when interacting with Spring AI applications, potentially leading to unauthorized actions within the application's environment. The impact depends on the specific tools made available to the model and the privileges those tools possess.

Unauthorized tool execution.
Exploits unvalidated tool dispatching.
Potential for privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Spring AI's tool calling feature could allow an unauthorized tool to be invoked, leading to potential privilege escalation. Application owners and platform teams are most likely responsible for addressing this issue. The first practical step is to identify all instances of affected Spring AI versions, confirm their exposure to untrusted input, and assess business criticality to prioritize remediation efforts.

Application owners should own the fix.
Verify tool list access controls.
Plan vendor coordination for updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Spring AI?

Spring AI is a framework designed for developers to build AI-powered applications within the Java ecosystem. It simplifies integrating large language models with existing enterprise software, allowing these applications to interact with external systems or data through defined 'tools' or functions.

What does CVE-2026-59318 mean for system security?

This CVE identifies a weakness known as CWE-863, which relates to incorrect authorization. In this context, the framework fails to strictly enforce the boundaries of which tools a model is allowed to use per request. Consequently, an attacker might bypass these intended restrictions to execute functions that were never authorized for a specific interaction.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specifically crafted requests to the application. The flaw lies in the tool dispatch logic; it is not triggered by standard, authorized AI queries. If the system fails to validate the tool list during the dispatch phase, it may execute an unintended tool, regardless of whether that tool was restricted for the current user's request.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal indicates that because Spring AI is frequently used for internet-facing web services or APIs, the attack surface is often directly exposed to the public network. Applications that accept untrusted user input to interact with AI-driven tool calling features are at a higher likelihood of being reachable by this vulnerability.

What should I do if I use Spring AI?

Begin by auditing your environment to locate all services running affected versions of Spring AI. Once identified, evaluate which applications handle sensitive functions via tool calling. Prioritize updating these components to the patched versions provided by the vendor to ensure that tool list enforcement is correctly applied to every request.

References

spring.io/security/cve-2026-59318

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.