Full Report
Spring security advisory (AV26-759)
Analysis Summary
# Vulnerability: Multiple Security Flaws in Spring Tools and Language Servers
## CVE Details
- **CVE ID:** CVE-2026-47858, CVE-2026-47873, CVE-2026-47882, CVE-2026-59326, CVE-2026-59327, CVE-2026-59328
- **CVSS Score:** Not explicitly provided in the bulletin, but CVE-2026-47858 (RCE) is typically categorized as **Critical/High**.
- **CWE:**
- CWE-94 (Code Injection)
- CWE-668 (Exposure of Resource to Wrong Sphere)
- CWE-338 (Use of Cryptographically Weak PRNG)
- CWE-312 (Cleartext Storage of Sensitive Information)
- CWE-79 (Cross-site Scripting)
## Affected Systems
- **Products:**
- Spring Tools for Eclipse
- Spring Tools for VSCode / Cursor / Theia
- **Versions:**
- Spring Tools for Eclipse: Versions ≤ 5.2.0
- Spring Tools for VSCode / Cursor / Theia: Versions ≤ 2.2.0
- **Configurations:** Systems utilizing "Live Information" startup mode, Docker integration, or Spring Boot DevTools remote features.
## Vulnerability Description
This advisory covers six distinct vulnerabilities within the Spring Tools ecosystem:
1. **CVE-2026-47858:** Remote Code Execution (RCE) flaw when "live information" startup mode is active.
2. **CVE-2026-47873:** Insecure Docker integration where unauthenticated Java Debug Wire Protocol (JDWP) and JMX ports are exposed on all network interfaces.
3. **CVE-2026-47882:** Security weakness where the Spring Boot DevTools remote secret is generated using a non-cryptographic Pseudo-Random Number Generator (PRNG), making it predictable.
4. **CVE-2026-59326:** Information disclosure where HTTP Proxy credentials are logged in plaintext by the Spring Boot Language Server.
5. **CVE-2026-59327:** Sensitive data exposure where the Spring Boot DevTools remote secret is stored in cleartext within Eclipse launch configurations.
6. **CVE-2026-59328:** Cross-Site Scripting (XSS) vulnerability within the dependency tooltips of the Eclipse Spring Boot Starter Wizard.
## Exploitation
- **Status:** PoC availability and active exploitation status not specified (Assume private PoC for RCE).
- **Complexity:** Varies (Low for cleartext logs; Medium/High for PRNG prediction and RCE).
- **Attack Vector:** Network (Remote) for RCE and exposed Docker ports; Local for log/configuration access.
## Impact
- **Confidentiality:** High (Plaintext credentials, remote secrets, and cleartext storage exposure).
- **Integrity:** High (Remote Code Execution and XSS).
- **Availability:** High (Potential for remote system takeover via RCE or JDWP exposure).
## Remediation
### Patches
Users are encouraged to update to the latest versions:
- **Spring Tools for Eclipse:** Upgrade to a version > 5.2.0.
- **Spring Tools for VSCode / Cursor / Theia:** Upgrade to a version > 2.2.0.
### Workarounds
- Disable "Live Information" startup mode if not required.
- Restrict network access to Docker containers and ensure JDWP/JMX ports are not reachable from external interfaces.
- Avoid using Spring Boot DevTools "Remote" features over untrusted networks.
- Manually clear logs containing HTTP proxy credentials.
## Detection
- **Indicators of compromise:** Unexpected listening ports (JDWP/JMX) on development machines; unauthorized entries in Spring Boot Language Server logs; unusual network traffic originating from IDE processes.
- **Detection methods and tools:** Network scanners (e.g., Nmap) to identify exposed debug ports; Log analysis for plaintext credential leakage.
## References
- Vendor Advisory (CVE-2026-47858): hxxps://spring[.]io/security/cve-2026-47858/
- Vendor Advisory (CVE-2026-47873): hxxps://spring[.]io/security/cve-2026-47873/
- Vendor Advisory (CVE-2026-47882): hxxps://spring[.]io/security/cve-2026-47882/
- Vendor Advisory (CVE-2026-59326): hxxps://spring[.]io/security/cve-2026-59326/
- Vendor Advisory (CVE-2026-59327): hxxps://spring[.]io/security/cve-2026-59327/
- Vendor Advisory (CVE-2026-59328): hxxps://spring[.]io/security/cve-2026-59328/
- Spring Security Main Page: hxxps://spring[.]io/security/