Description

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation. Affected versions: Spring AI: 2.0.0 Spring AI: 1.1.0 through 1.1.8 Spring AI: 1.0.0 through 1.0.9

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-21T12:16:30.390Z",
  "pubdate": "2026-08-21T12:16:30.390Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Spring AI's tool calling support mechanism where per-request tool restrictions are insufficiently enforced during tool dispatch operations.\nThe vulnerability affects Spring AI versions 2.0.0, 1.1.0 through 1.1.8, and 1.0.0 through 1.0.9.\nThe flaw allows unauthorized execution of tools that were explicitly excluded from the current request's advertised tool list, breaking the intended security boundary between different context requests.\nAn attacker capable of manipulating model interactions or exploiting the lax enforcement mechanism can invoke restricted tools, potentially leading to unauthorized operations, data access, or privilege escalation within the application architecture.\nExploitation requires conditions where unadvertised tools can be targeted or dispatched during the execution phase despite not being authorized for the specific active request.",
  "technicalDetails": "The root cause of the vulnerability lies in the validation and dispatch logic of Spring AI's tool calling support component.\nWhile the per-request tool list is correctly advertised to the language model as a structural boundary, the subsequent dispatch handling fails to strictly enforce these boundaries at execution time.\nSpecifically, when a tool call is returned and processed, the internal dispatch mechanism does not adequately verify whether the requested tool was included in the specific set of tools authorized for that particular request.\nConsequently, under certain conditions, a tool that was omitted from the current request scope can still be successfully invoked.\nThe attack flow proceeds as follows: an application initiates a request with a restricted subset of tools advertised to the model; the model generates a tool call targeting a functionality that was intentionally withheld from the active request context; due to the absence of robust enforcement during the dispatch phase, the framework accepts the invocation and executes the unadvertised tool.\nThis breaks the principle of least privilege regarding per-request tool availability, allowing unauthorized access to backend functions or capabilities associated with restricted tools.\nAffected versions include Spring AI 2.0.0, 1.1.0 through 1.1.8, and 1.0.0 through 1.0.9.\nThe vulnerability impacts the core tool calling execution pipeline, exposing applications to potential privilege escalation if strict authorization checks are bypassed during dispatch."
}