Spring AI EUVD-2026-63933

Requires the target application to be built on an affected Spring AI version (1.0.0-1.0.9, 1.1.0-1.1.8, or 2.0.0) AND to actually use the tool-calling feature with a per-request tool list that restricts at least one tool relative to others. Exploitation further depends on the attacker being able to influence the model's input for a request and on the framework dispatching a tool outside the advertised boundary - the description explicitly limits this to occurring 'under certain conditions,' so it is not universally reproducible. Limiting factors: applications not using tool calling, or exposing a uniform tool set with no privilege differential, are not meaningfully affected; realized impact is bounded by the capabilities of the improperly-invoked tool.

This is a CWE-863 incorrect-authorization flaw in Spring AI's tool-calling layer: the per-request tool allow-list is advertised to the model but not fully enforced at dispatch, so a tool outside the request's boundary can be invoked. The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N, full C:H/I:H/A:H) and SSVC Technical Impact of 'total' present this as a maximum-severity network flaw, but multiple signals argue against treating it as an urgent internet-wide priority. SSVC Exploitation is 'none' and Automatable is 'no'; EPSS is 0.17% (7th percentile); it is not in CISA KEV and no public exploit is identified. Critically, the description itself qualifies the flaw as occurring only 'under certain conditions,' which contradicts the AC:L in the vendor vector - real exploitation depends on the host application actually using tool calling, exposing multiple tools with differing privilege, and an attacker being able to influence model input to steer dispatch toward an out-of-scope tool. The blast radius (C/I/A) is also entirely a function of what the improperly-reachable tool does, so the uniform C:H/I:H/A:H is an upper bound rather than a guaranteed outcome. Net: a genuine and worth-patching authorization weakness in a fast-growing framework, but current evidence points to conditional/targeted rather than mass exploitation, and the 9.8 is likely over-scored for the average deployment.

An application built on a vulnerable Spring AI version exposes several tools to an LLM but restricts a sensitive tool (e.g., an administrative or data-mutating function) from a given request context. An attacker who can shape the request's model input crafts prompts that induce the model to emit a call to the restricted tool, which the framework dispatches despite it being outside the advertised per-request boundary, achieving privilege escalation. No public exploit code is identified, and the description notes this only triggers under certain conditions, so reliability depends on the specific tool wiring.