Loading vulnerability…
Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
CVE-2026-59327 is an information exposure vulnerability in Spring Tools for Eclipse 5.2.0 and earlier. The product stores the Spring Boot DevTools remote secret, configured through spring.devtools.remote.secret, as a plain string attribute in the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML in workspace metadata or, when the configuration is shared, in project files that may be committed to version control. Because this secret is the sole credential protecting the Spring Boot DevTools remote restart and reload endpoint, disclosure of the launch configuration allows an attacker to recover the secret and authenticate to that endpoint. The endpoint can then be used to submit and execute arbitrary class bytes on the associated Spring Boot application, leading to remote code execution.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exposure of the stored Spring Boot DevTools remote secret enables compromise of the associated Spring Boot application's DevTools remote restart or reload interface. An attacker who obtains the secret can authenticate to the protected endpoint and execute arbitrary class bytes on the target application. This can result in remote code execution in the context of the application, with consequent risks including application takeover, unauthorized code deployment, data access, service manipulation, and potential follow-on lateral movement depending on the privileges and environment of the affected service.
If you can’t patch tonight, do this now.
Restrict access to Eclipse workspace metadata and launch configuration files to trusted users only. Do not mark affected launch configurations as shared if they contain the Spring Boot DevTools remote secret, and do not commit such configuration files to version control or include them in broadly accessible backups. Where remote DevTools functionality is not required, disable it. If exposure is suspected, immediately rotate the remote secret and remove any cleartext copies from local workspaces, repositories, and backup artifacts.
Patch, then assume compromise.
Upgrade Spring Tools for Eclipse to a fixed version newer than 5.2.0 when available. Review existing Eclipse launch configurations created for the Spring Boot DevTools Client and treat any stored remote secrets as potentially exposed. Rotate or replace affected spring.devtools.remote.secret values on associated Spring Boot applications, remove secrets from persisted launch configurations where possible, and ensure shared launch configuration files containing the secret are no longer distributed or retained in project history.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.