VulnSocial

CVE-2026-59318Disclosure(vmware / spring_ai)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch vmware spring_ai systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could be invoked, potentially leading to privilege escalation. Affected versions: Spring AI: 2.0.0 Spring AI: 1.1.0 through 1.1.8 Spring AI: 1.0.0 through 1.0.9

vmware CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-863

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • spring_ai

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
vmware
Products
spring_ai

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-02: 1Patch / Workaround · 2026-09-02: 109-02
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • iototsecnews@iototsecnews
    Disclosure

    Spring Framework の 91件の脆弱性が FIX：ソフトウェア・サプライチェーン上の 209,569 個のコンポーネントに影響 https://iototsecnews.jp/2026/08/25/91-spring-cves-impact-over-209000-software-components-across-the-supply-chain/ Broadcom により、Spring Framework および関連プロジェクトに影響を及ぼす多数の脆弱性が公表されました。開発における AI 活用で脆弱性の発見速度が急増する一方、複雑な依存関係への対応が追いつかない背景があります。直接的な依存のみならず推移的依存パッケージへの波及／開発資産の不透明化／未承認ツール呼び出しによる権限昇格などの問題が生じます。対応策としては SBOM 等を活用した影響範囲特定／修正版への更新／アプリケーション層での制御徹底が推奨されます。なお記事では CVE-2026-59285／CVE-2026-59318 が解説されています。迅速な確認と自動化された継続的対策が求められます。 #CVE202659285 #CVE202659318 #Framework #Spring #Vulnerability

    Post summary

    Broadcom has publicly disclosed 91 CVEs affecting the Spring Framework, urging the use of SBOM and updates to patched releases to mitigate the identified risks.

    0000091
    510 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appvmwarespring_ai---

Explore more

Back to dashboardvmware CVEsspring_ai vulnerabilities