What is the CVSS score of CVE-2026-59327?

CVE-2026-59327 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Spring Tools Eclipse CVE-2026-59327

EUVD-2026-50974 MEDIUM

Cleartext Storage of Sensitive Information (CWE-312)

2026-07-30 vmware

GHSA-xg26-wm7c-xr7g

RCE Java Spring Spring Tools For Eclipse

4.4

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

4.4 MEDIUM

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Scope changes to Spring Boot app where RCE is achieved; no privileges required to read a publicly committed VCS file; UI:R for developer's act of sharing/committing config.

3.1 AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:59 vuln.today

DescriptionCVE.org

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the user marks the configuration as a shared file, directly into the project tree where it can be committed to version control. This secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes on the target application. Anyone able to read the .launch file (via filesystem access, a workspace backup, or a shared VCS repository) can extract the secret and use it to achieve remote code execution against the associated Spring Boot application. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

AnalysisAI

Cleartext credential storage in Spring Tools for Eclipse 5.2.0 and earlier exposes the Spring Boot DevTools remote secret (spring.devtools.remote.secret) in Eclipse .launch XML configuration files, which Eclipse persists to either workspace metadata or - critically - directly into the project tree when marked as a shared configuration. The exposed secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes, converting a credential-disclosure flaw into a remote code execution primitive against the associated Spring Boot application. No public exploit has been identified at time of analysis, but the attack technique is mechanically straightforward once the secret is retrieved from a committed VCS file or accessible workspace backup.

Technical ContextAI

Spring Boot DevTools ships a remote development feature that allows an IDE to push class and resource changes to a running application over HTTP, authenticated solely by a shared secret configured as spring.devtools.remote.secret. Spring Tools for Eclipse (STS) stores this secret as a plain string attribute in the Eclipse launch configuration format - XML files with a .launch extension. Eclipse persists these files either to workspace-scoped .metadata/ storage or, when a developer marks the configuration as a shared resource, directly into the project directory structure. Project-scoped .launch files are routinely version-controlled alongside source code. The affected product is identified by CPE cpe:2.3:a:spring:spring_tools_for_eclipse:*:*:*:*:*:*:*:* covering all versions through 5.2.0. The root cause aligns with CWE-312 (Cleartext Storage of Sensitive Information), though NVD lists CWE as N/A for this entry: a security credential is serialized in human-readable format into a file artifact whose access control assumptions can easily be violated by normal developer workflow (sharing or committing the configuration).

RemediationAI

Upgrade Spring Tools for Eclipse to the version that addresses CVE-2026-59327 once released - consult the vendor advisory at https://spring.io/security/cve-2026-59327 for the exact fixed version, as the patched release number is not independently confirmed in the available data. As immediate compensating controls: audit all version-controlled repositories for committed .launch files referencing spring.devtools.remote.secret and, if found, rotate the secret value immediately in both the application configuration and the launch file, then remove the historical commit from VCS history using git filter-repo or BFG Repo Cleaner (note: this requires force-pushing to shared remotes and coordinating with all collaborators). Add *.launch to .gitignore to prevent future accidental commits; this has no operational side effect. If DevTools remote is not actively required, disable the feature entirely by removing spring.devtools.remote.secret from all application*.properties / application*.yml files and ensuring the spring-boot-devtools artifact is excluded from production classpath configurations - this eliminates the second-stage RCE vector entirely. Where DevTools remote must remain active, restrict network access to the DevTools remote port at the perimeter or host-based firewall to reduce exposure of the second-stage endpoint, noting this does not address the credential-disclosure vulnerability itself.