Description

When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness.

Practical exploitability is low: deriving the generator state would require an additional information leak from the same IDE process or an offline brute-force of the generator seed, and an online brute-force against the target application's HTTP endpoint is infeasible. The severity is therefore assessed as Low, despite the high theoretical impact of the affected endpoint.

Affected Spring Products and Versions

Spring Tools for Eclipse:

• 5.2.0 and earlier

All versions prior to version 5 (no longer supported) are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

The fix generates the DevTools remote secret using a cryptographically secure random number generator. After upgrading, a new secret is generated the next time remote DevTools support is enabled for a project.

No further mitigation steps are necessary.

Workaround for unpatched versions: Avoid enabling remote DevTools support on remote Boot Dashboard targets, and ensure that the DevTools remote-restart HTTP endpoint of any deployed application is not reachable by untrusted networks.

References

• Assessed severity: Low (based on practical exploitability)
• CVSS 3.1 vector (theoretical impact): CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H (base 8.3) — reflects the impact of the affected endpoint, but the realized risk is reduced by the difficulty of recovering the generator state, as described above
• CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

History

• 2026-07-29: Initial vulnerability report published.