Spain needed a superb last-minute save from Chelsea goalkeeper Kepa Arrizabalaga to keep up their 100% record in Group F.
Kepa denied Reading striker George Puscas with his legs as 10-man Spain recorded a first win in Romania.
Sergio Ramos put Spain ahead from the penalty spot before Borussia Dortmund forward Paco Alcacer steered in.
Former Brighton forward Florin Andone headed in and defender Diego Llorente was sent off, but Spain held on.
Kepa – who has replaced Manchester United’s David de Gea as first choice – made sure Spain took the points when he reacted superbly to stop Puscas’ header from close range.
The match was the first since Robert Moreno permanently replaced Luis Enrique as head coach, and there was a minute’s silence in memory of Enrique’s nine-year-old daughter, Xana, who died last week.
Next up for the former European champions is a home game against the Faroe Islands on Monday.
