CVE-2026-47882highCWE-338

CVE-2026-47882: high-severity vulnerability in Spring Tools for Eclipse

Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

Published · Updated

Follow this CVE+ Monitor Spring Tools for Eclipse

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 0.2%
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Spring · Spring Tools for Eclipse
Related CVEs — Spring Tools for Eclipse

In the same product, most dangerous first.

CVE-2026-47858HIGHlive information startup mode is vulnerable for remote code executionEPSS 0.3%CVE-2026-47873HIGHSpring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfacesEPSS 0.3%CVE-2026-59328MEDIUMCross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency TooltipsEPSS 0.2%CVE-2026-59326LOWHTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language ServerEPSS 0.1%CVE-2026-59327MEDIUMCleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch ConfigurationsEPSS 0.1%