Spring Tools Eclipse CVE-2026-59327

Two preconditions must both be satisfied for exploitation: first, the attacker must be able to read the .launch Eclipse configuration file - this occurs when the developer has marked the configuration as a shared file and committed it to a VCS repository accessible to the attacker (internal or public), or when the attacker gains filesystem or backup access to the Eclipse workspace .metadata/ directory. Second, the targeted Spring Boot application must be actively running with the DevTools remote feature enabled, meaning spring.devtools.remote.secret is set in its configuration and the application was started with spring-boot-devtools on the classpath and DevTools remote not explicitly disabled. The CVSS vector (PR:L/UI:R) indicates that a low-privileged user who performs the specific action of sharing or committing the launch configuration is required to create the vulnerable condition; absent this action, the secret remains local to the developer's machine. Exploitation is further bounded by Spring's own guidance that DevTools remote must never be run in production environments, limiting realistic targets to development, staging, and CI/CD deployments. What limits exploitation: DevTools remote is a non-default development-time feature; production applications running without spring-boot-devtools on the classpath are entirely unaffected regardless of whether the .launch file is exposed.

The official CVSS 3.1 score of 4.4 with vector AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N scopes only the credential-disclosure step (C:H for the exposed secret, I:N/A:N for STS itself) and significantly understates the practical business risk. The described exploit chain is two-stage: (1) read the plaintext secret from the .launch file, (2) use that secret to send arbitrary class bytes to the DevTools remote endpoint for execution on the target JVM - this second stage constitutes remote code execution on a separate system (the Spring Boot application), which the CVSS scope-unchanged rating does not capture. When the .launch file is committed to a shared or public VCS repository the effective attack vector expands from local to network, further undermining the AV:L designation. No EPSS data was provided in the intelligence input. The vulnerability is not listed in CISA KEV and no POC has been publicly identified, indicating no confirmed active exploitation at time of analysis. Real-world blast radius is bounded by the requirement that DevTools remote must be actively configured in the target environment - Spring's documentation explicitly warns against running DevTools in production, so exposure is primarily limited to development, staging, and CI/CD environments where this feature is intentionally used. That said, CI/CD RCE can be extremely high-value for attackers.

An attacker with read access to a shared or public Git repository discovers a committed *.launch Eclipse configuration file in the project tree. Parsing the XML, they extract the plaintext value of the spring.devtools.remote.secret attribute, then craft HTTP requests authenticated with that secret to the target Spring Boot application's DevTools remote restart endpoint, uploading malicious compiled Java class bytes that execute arbitrary code within the running JVM process on the application server.