EUVD-2026-50974
GHSA-xg26-wm7c-xr7g
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Scope changes to Spring Boot app where RCE is achieved; no privileges required to read a publicly committed VCS file; UI:R for developer's act of sharing/committing config.
Primary rating from Vendor (vmware).
CVSS VectorVendor: vmware
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the user marks the configuration as a shared file, directly into the project tree where it can be committed to version control. This secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes on the target application. Anyone able to read the .launch file (via filesystem access, a workspace backup, or a shared VCS repository) can extract the secret and use it to achieve remote code execution against the associated Spring Boot application. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
AnalysisAI
Cleartext credential storage in Spring Tools for Eclipse 5.2.0 and earlier exposes the Spring Boot DevTools remote secret (spring.devtools.remote.secret) in Eclipse .launch XML configuration files, which Eclipse persists to either workspace metadata or - critically - directly into the project tree when marked as a shared configuration. The exposed secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes, converting a credential-disclosure flaw into a remote code execution primitive against the associated Spring Boot application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two preconditions must both be satisfied for exploitation: first, the attacker must be able to read the `.launch` Eclipse configuration file - this occurs when the developer has marked the configuration as a shared file and committed it to a VCS repository accessible to the attacker (internal or public), or when the attacker gains filesystem or backup access to the Eclipse workspace `.metadata/` directory. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score of 4.4 with vector AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N scopes only the credential-disclosure step (C:H for the exposed secret, I:N/A:N for STS itself) and significantly understates the practical business risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with read access to a shared or public Git repository discovers a committed `*.launch` Eclipse configuration file in the project tree. Parsing the XML, they extract the plaintext value of the `spring.devtools.remote.secret` attribute, then craft HTTP requests authenticated with that secret to the target Spring Boot application's DevTools remote restart endpoint, uploading malicious compiled Java class bytes that execute arbitrary code within the running JVM process on the application server. |
| Remediation | Upgrade Spring Tools for Eclipse to the version that addresses CVE-2026-59327 once released - consult the vendor advisory at https://spring.io/security/cve-2026-59327 for the exact fixed version, as the patched release number is not independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allShare
External POC / Exploit Code
Leaving vuln.today