Spring AI advertised the tool list as a boundary. Dispatch never enforced it

Spring's August advisory batch for Spring AI contains one entry that is worth more attention than its MEDIUM rating suggests. CVE-2026-59318, published 2026-08-20, is not a memory bug or a parsing failure. It is a design assumption that turned out to be wrong, and the assumption is one that most agent frameworks share.

The advisory's own description is the whole story in one sentence:

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched.

Spring security advisory, CVE-2026-59318

Advertised versus enforced

When an application calls a chat model with tools, it sends a list of tool definitions along with the prompt. The natural reading — and the reading a lot of code has been written against — is that this list is the set of things the model can cause to happen on this request. Give the customer-support agent three read-only lookups and it has three read-only lookups, whatever the incoming message says.

Spring's title for the fix names the gap precisely: "DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via Prompt Injection". The per-request list governed what the model was told about. Dispatch, on the other hand, resolved a requested tool name through a global resolver, and a global resolver knows about every tool registered in the application context — including the ones deliberately left off this request. A model that can be steered into naming a tool it was never offered gets that tool executed.

That is why the advisory rates confidentiality impact HIGH and marks the scope as changed. The published CVSS v3.1 vector is AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N — network reachable, but high attack complexity, requiring low privileges and user interaction. The MEDIUM headline severity comes from those preconditions, not from the consequence. The consequence is privilege escalation across a boundary the application believed it had drawn.

Credit in the advisory goes to Arjun Basnet (Securin) and ChangMin Lee.

Affected and fixed

Affected versions are Spring AI 2.0.0, 1.1.0 through 1.1.8, and 1.0.0 through 1.0.9 — which is to say every released line. Fixed versions are 2.0.1 for open source, and 2.0.0.1, 1.1.9, and 1.0.10 for commercial support subscribers only. The advisory's remediation text is one line: "Users of affected versions should upgrade to the corresponding fixed version."

Spring AI 2.0.1 shipped on 2026-08-21. Two of the release's other changes are worth reading as part of the same fix rather than as unrelated hardening. The release notes state that "Tool resolution fallback is now configurable: you decide whether an unresolvable tool name fails fast or falls back," and that "ToolCallingAdvisor now accepts a configurable limit on the number of tool calls per request, and raises ToolCallLimitExceededException when the limit is reached."

The first of those is the actual remedy for the CVE class: the fallback that made the boundary porous is now a decision the application makes, and fail-fast is the option to pick unless you have a specific reason not to. The second is an independent containment control — a bounded agentic loop cannot be turned into an unbounded one by a document that keeps asking for one more tool call.

The other six

CVE-2026-59318 arrived alongside six more fixes in the same release. Two were published as full Spring advisories on 2026-08-20:

• CVE-2026-47851 (HIGH) — "Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader". The advisory: "Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread." Vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — no privileges, no interaction, availability impact. If you ingest user-supplied PDFs, this is the one to patch first.
• CVE-2026-47852 (HIGH) — "Predictable cache directory location allows local ONNX model substitution in Spring AI". Per the advisory, "A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file." Vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N: integrity, not confidentiality. The model file itself is the payload.

The remaining four are listed in the release announcement: CVE-2026-59279 (unbounded persistent session allocation via repeated initialize requests), CVE-2026-59294 (arbitrary file write via path traversal in ResourceCacheService), CVE-2026-59308 (semantic cache cross-tenant isolation bypass via SHA-256 truncation), and CVE-2026-59319 (RediSearch tag injection in RedisChatMemoryRepository allowing cross-conversation data exposure).

Read as a set, they are a catalog of the new plumbing an AI framework adds: a document ingester, a model cache, a session allocator, a semantic cache, and a chat-memory store. Five subsystems, five ways to reach across a tenancy or trust boundary. None of them existed in a Spring app three years ago.

What to change

Upgrade to 2.0.1, or the supported 1.x equivalent if you pay for it. Then treat the configurable fallback as the real fix and set it to fail fast, because the upgrade alone restores the boundary only if you tell it to. Set a tool-call limit on ToolCallingAdvisor while you are in the file.

Beyond the patch, the useful takeaway is an audit question for any agent framework, not just this one: when your code narrows the tool list for a request, is the narrowing enforced at dispatch, or is it only what the model was told? Those are different guarantees, and the second one is not a security control. Spring's advisory is the rare case where a vendor says so in its own words.

Primary sources: Spring security advisory CVE-2026-59318, CVE-2026-47851, CVE-2026-47852, Spring AI 2.0.1 Available Now, read 2026-08-25.