The vulnerability allows an attacker to cause the language model to call a tool that was not listed in the current request’s advertised tool list. It is inferred that this would be achieved by injecting a prompt that triggers the model to request the unintended tool, exposing an enforcement weakness that permits improper authorization.

Relevant vendors include Spring:Spring AI. Affected releases are Spring AI 2.0.0 as well as all versions 1.1.0 through 1.1.8 and 1.0.0 through 1.0.9.

The CVSS score of 6.5 indicates a moderate‑to‑high severity. It is inferred that exploitation would require a crafted prompt processed by the AI engine, a capability an attacker could obtain if they can interact with the model directly. Because the EPSS score is not available, the public data does not indicate a current exploitation trend. The vulnerability is not listed in the CISA KEV catalog. The impact is confined to the application hosting the Spring AI engine; however, any successful privileged operation via a tool could compromise the entire system.