Loading vulnerability…
Weak Spring Boot DevTools remote secret generation in Spring Tools for Eclipse
CVE-2026-47882 is a weakness in Spring Tools for Eclipse affecting version 5.2.0 and earlier. When the Spring Tools Boot Dashboard is used to enable Spring Boot DevTools support for a remote application target, such as a Docker container or Cloud Foundry application, the tooling generates the shared secret used to authenticate DevTools remote-restart uploads to the deployed application. That secret is generated with a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. As a result, the entropy and unpredictability of the authentication secret may be insufficient for its security purpose, weakening the trust boundary around the remote-restart mechanism.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
The primary impact is weakening of the authentication protecting Spring Boot DevTools remote-restart uploads for remote application targets. If an attacker can predict, recover, or otherwise exploit the insufficiently random shared secret, the attacker could bypass or undermine the intended authentication for the remote restart channel. The published CVSS vector indicates potential high impact to confidentiality, integrity, and availability under the affected deployment conditions.
If you can’t patch tonight, do this now.
Until a fixed version is deployed, avoid enabling Spring Boot DevTools remote support for remote application targets where this generated shared secret would be relied upon for authentication. If remote DevTools support is operationally necessary, reduce exposure by limiting network reachability to the remote application target and restricting who can interact with the remote-restart functionality.
Patch, then assume compromise.
Upgrade Spring Tools for Eclipse to a vendor-fixed release once available. Affected versions are 5.2.0 and earlier. The corrective action is to ensure the shared secret for DevTools remote support is generated using a cryptographically secure source of randomness.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.