CVE-2026-59327: Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the user marks the configuration as a shared file, directly into the project tree where it can be committed to version control. This secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes on the target application. Anyone able to read the .launch file (via filesystem access, a workspace backup, or a shared VCS repository) can extract the secret and use it to achieve remote code execution against the associated Spring Boot application. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Because Spring Tools for Eclipse (5.2.0 and earlier) stores the Spring Boot DevTools remote secret as a cleartext plain string attribute in the Eclipse launch configuration XML, replace the existing value for the "Spring Boot DevTools Client" launch configuration with a new secret value.
Spring Tools for Eclipse spring.devtools.remote.secret (Spring Boot DevTools Client launch configuration) = Rotate/change the remote secret to a new strong value (do not reuse any previously exposed secret)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59327?
The severity of CVE-2026-59327 is rated as medium with a score of 4.4.
How do I fix CVE-2026-59327?
To fix CVE-2026-59327, ensure that sensitive information like the Spring Boot DevTools remote secret is stored securely and not in plain text.
What software is affected by CVE-2026-59327?
CVE-2026-59327 affects Spring Tools for Eclipse.
What is the impact of CVE-2026-59327?
The impact of CVE-2026-59327 includes the potential exposure of sensitive remote secret information due to cleartext storage.
When was CVE-2026-59327 published?
CVE-2026-59327 was published on July 30, 2026.