Executive brief
Spring Tools for Eclipse, a development environment for building Spring applications, incorrectly stores sensitive credentials in plain text. If these credentials are leaked—for example, by committing project files to a public repository—an attacker could gain the ability to remotely execute unauthorized code on the associated application. This could lead to a full system compromise or unauthorized access to application data.
Technical details
Spring Tools for Eclipse (versions 5.2.0 and earlier) stores the 'spring.devtools.remote.secret' as a cleartext string within the 'Spring Boot DevTools Client' launch configuration. Because Eclipse persists these configurations as XML files (.launch) in workspace metadata or the project tree, the secret can be exposed via filesystem access or version control systems. This secret is the primary authentication mechanism for the DevTools remote restart endpoint. An attacker who obtains this secret can send malicious class bytes to the endpoint, resulting in remote code execution (RCE) on the target Spring Boot application.
Affected products
- Spring Spring Tools for Eclipse 5.2.0 and earlier
Timeline
- 2026-07-30: advisory: Advisory published by VMware and NVD