CVE-2026-59327: Spring Boot DevTools Remote Key Stored in Plaintext Leading to RCE

Vulnerability Overview CVE-2026-59327: Spring Boot DevTools Remote Secret Stored in Plaintext in Eclipse Launch Configuration Description: Spring Tools for Eclipse stores the Spring Boot DevTools remote secret ( ) as a plain text attribute in the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as plaintext XML, either in the workspace metadata or in the project tree of user-marked shared files for submission to version control. The secret is the sole credential protecting the DevTools remote restart/reload endpoints on the target application. Anyone with access to read the files (via file system access, workspace backups, or shared VCS repositories) can extract the secret and use it to achieve remote code execution against affected Spring Boot applications. Affected Versions Affected Spring Products and Versions: - Spring Tools for Eclipse: 5.2.0 and earlier - All versions prior to 5 (no longer supported) are also affected. - Spring Tools for VSCode / Cursor / Theia are unaffected, as this launch configuration mechanism is specific to the Eclipse IDE. Remediation Mitigation: - Upgraded affected versions to the corresponding patched version. - Patched Version: 5.3.0 - Availability: OSS Workarounds for Unpatched Versions: - Do not mark the "Spring Boot DevTools Client" launch configuration as a shared/exported file, and avoid committing files containing the attribute. - If the secret has already been exposed, rotate on the affected application. References CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (4.4, Medium) History 2026-07-29: Initial vulnerability report published.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-59327: Spring Boot DevTools Remote Key Stored in Plaintext Leading to RCE