CVE-2026-47882: Spring Boot DevTools remote secret generation uses non-cryptographic PRNG

Vulnerability Overview CVE ID: CVE-2026-47882 Vulnerability Name: Spring Boot DevTools Remote Secret Generation Uses Non-Cryptographic Pseudo-Random Number Generator Description: When Spring Boot DevTools support for remote application targets (e.g., Docker containers or Cloud Foundry applications) is enabled, Spring Tools generates a shared secret to verify DevTools remote restarts and uploads to the deployed application. This secret is generated using a non-cryptographic pseudo-random number generator (PRNG) instead of a cryptographic secure random number generator. Real-world Exploitability: Low. Deriving the generator state requires additional information leakage, such as from the same IDE process or offline brute-forcing of the generator seed. Online brute-forcing of the target application's HTTP endpoints is not feasible. Therefore, despite the high theoretical impact, the severity is assessed as low. Affected Scope Affected Products and Versions: - Spring Tools for Eclipse: 5.2.0 and earlier versions - All versions prior to version 5 (no longer supported) are also affected Remediation Mitigation: - Upgrade affected versions to the corresponding patched version. - Patched Version: 5.3.0 - Availability: OSS (Open Source Software) - After the fix, the DevTools remote secret will be generated using a cryptographically secure random number generator. Upon upgrading, a new secret will be generated the next time remote DevTools support is enabled. - No further mitigation steps are required. Workaround for Unpatched Versions: - Avoid enabling remote DevTools support on remote Boot Dashboard targets and ensure that the DevTools remote restart HTTP endpoint of any deployed application is not accessible to untrusted networks. References Severity Assessment: Low (based on real-world exploitability) CVSS 3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H (base 8.3) — reflects the impact on the affected endpoint, but the actual risk is reduced due to the difficulty of recovering the generator state. CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) History 2026-07-29: Initial vulnerability report published. Reporting Vulnerabilities To report security vulnerabilities in the Spring project portfolio, please refer to the Security Policy. --- Summary: Vulnerability Overview: Spring Boot DevTools uses a non-cryptographic pseudo-random number generator to generate remote secrets, posing a potential security risk. Affected Scope: Spring Tools for Eclipse 5.2.0 and earlier versions, as well as all versions prior to version 5. Remediation: Upgrade to version 5.3.0, avoid enabling remote DevTools support on remote Boot Dashboard targets, and ensure that the DevTools remote restart HTTP endpoint is not accessible to untrusted networks.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-47882: Spring Boot DevTools remote secret generation uses non-cryptographic PRNG