CVE-2026-47882
Received Received - Intake

Spring Tools DevTools Remote Restart Authentication Bypass

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: VMware

Description
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-30
Last Modified
2026-07-30
Generated
2026-07-30
AI Q&A
2026-07-30
EPSS Evaluated
N/A
NVD
CVE-2026-47882
EUVD
EUVD-2026-50973

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vmware spring_tools_for_eclipse to 5.2.0 (exc)
spring tools_for_eclipse to 5.3.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Spring Boot DevTools generating a shared secret for authenticating remote-restart uploads using a non-cryptographic pseudo-random number generator instead of a secure method. This affects Spring Tools for Eclipse versions 5.2.0 and earlier.

Detection Guidance

Check if Spring Tools for Eclipse versions 5.2.0 or earlier are installed. Inspect network traffic for DevTools remote-restart HTTP endpoints exposed to untrusted networks. Verify if shared secrets for remote DevTools are generated using weak PRNG methods.

Impact Analysis

The impact is theoretical but high due to potential unauthorized access to remote-restart uploads if the weak secret is exploited. Practical exploitability is low because recovering the generator state or brute-forcing the seed is difficult.

Mitigation Strategies

Upgrade to Spring Tools for Eclipse version 5.3.0 or later. Disable remote DevTools support on remote targets if upgrading is not possible. Ensure the DevTools remote-restart HTTP endpoint is not accessible from untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47882. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart