CVE-2026-47882 Details
Description
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
A vulnerability exists in Spring Tools for Eclipse versions 5.2.0 and earlier, related to the generation of shared secrets for remote Spring Boot DevTools support. These secrets, which authenticate remote-restart uploads to deployed applications, were created using a non-cryptographic pseudo-random number generator, lacking cryptographic security. This vulnerability could theoretically allow an attacker to derive the generator state and exploit the application's HTTP endpoint, but practical exploitability is low due to the difficulty of recovering the generator state without additional information or through brute-force methods.
Users should upgrade to Spring Tools for Eclipse version 5.3.0 or later, where the shared secret is generated using a cryptographically secure random number generator. After upgrading, a new secret will be generated the next time remote DevTools support is enabled for a project. For those unable to upgrade, it is recommended to avoid enabling remote DevTools support on affected targets and to ensure that the DevTools remote-restart HTTP endpoint is not accessible from untrusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://spring.io/security/cve-2026-47882 | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | CISA-ADP |
Affected Products
No affected product data is available for this CVE.
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 1, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |