Vulnerability · Published Jul 30, 2026 · Assigned by vmware

CVE-2026-47882Spring Boot DevTools remote secret generated with a non-cryptographic PRNG

High 8.3

In plain English

A high-severity security flaw in Spring Tools for Eclipse from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)8.3High

Exploit odds (30 days)0.2%top 84.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

Affected products (as reported)

Vendor	Product	Versions
Spring	Spring Tools for Eclipse	0 – through 5.2.0

Weakness: CWE-338 · Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://spring.io/security/cve-2026-47882