← Vulnerability feed

Vulnerability record · CVE-2026-47882 · published 30 July 2026

CVE-2026-47882: When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or …

When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

8.3 CVSS 3.1 High EPSS 0.24% · top 86.4% CWE-338 · CWE-338 Undergoing Analysis
8.3CVSS 3.1 base score
0.24%EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
1References
1 Aug 2026Last modified by NVD

Description

When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

LinkTags
https://spring.io/security/cve-2026-47882

Track CVE-2026-47882 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2026-47882), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.