CVE-2026-47882
High · 8.3CVSS
8.3
EPSS
0.2%
Published
Jul 30, 2026
CISA due date
—
The record
When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret was generated using a non-cryptographic pseudo-random number generator rather than a cryptographically secure source of randomness. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118986 CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing… CWE-338
- CVE-2026-102813 An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. CWE-338
- CVE-2026-74887 openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne… CWE-338
- CVE-2026-73567 sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms… CWE-338
- CVE-2026-71851 crypto-js is a JavaScript library of crypto standards. CWE-338
- CVE-2026-9205 IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the… CWE-338
- CVE-2026-64798 Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension… CWE-338
- CVE-2026-16615 A flaw was found in librest. CWE-338