I start most mornings the same way: coffee, then the Spring blog RSS feed, then whatever my agents did overnight. Yesterday the feed had something I did not expect in a maintenance release. Spring AI 2.0.1, announced August 21 by Christian Tzolov, is the first patch release on top of June's 2.0.0 GA. It carries more than 80 issues and pull requests. Buried under the streaming fixes and the tool call limits is a list most teams will scroll past: seven CVEs, all disclosed August 20, all fixed in 2.0.1.
I run Spring Boot services with Spring AI in production, and I write about Java and AI every week, so I went and read all seven advisories on spring.io instead of skimming the headline. Two of them change how I think about my own agent setup. If you have anything running on Spring AI 1.0.x, 1.1.x, or 2.0.0, here is what actually matters in this release, ranked by how likely it is to touch your system.
The one that should worry agent builders most
CVE-2026-59318: unadvertised tool dispatch via prompt injection. Rated MEDIUM, and I would argue that label undersells it for anyone running multi-tenant agents.
Here is the mechanism, straight from the advisory. In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary, but that boundary is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that was not made available to the current request could still be invoked, potentially leading to privilege escalation.
