SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-59327

MEDIUM · CVSS 4.4 EPSS 0.09% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-30 · Last synced 2026-08-29

CyberRota Analysis

AI-Generated

Spring Tools for Eclipse versions 5.2.0 and earlier are vulnerable due to the insecure storage of the DevTools remote secret in cleartext XML within launch configuration files. This exposure allows unauthorized users with filesystem access or version control visibility to extract the secret, potentially leading to remote code execution on the associated Spring Boot application. Organizations using these versions should prioritize remediation to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-59327
Severity
MEDIUM
CVSS
4.4
EPSS
0.09%

Original NVD Description

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the user marks the configuration as a shared file, directly into the project tree where it can be committed to version control. This secret is the sole credential protecting the DevTools remote restart/reload endpoint, which accepts and executes arbitrary class bytes on the target application. Anyone able to read the .launch file (via filesystem access, a workspace backup, or a shared VCS repository) can extract the secret and use it to achieve remote code execution against the associated Spring Boot application. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier