High severity · published Jul 30, 2026
CVE-2026-47873
Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces
8.0
CVSS
0.3%
EPSS
No
On KEV
Description
The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback.
Affected Spring Products and Versions:
Spring Tools for Eclipse: 5.2.0 and earlier
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
Spring Tools for Eclipse · Spring
through 5.2.0 · source: vendor
ST
Spring Tools · Broadcom
before 5.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47873
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47873
Vendor Advisory
https://spring.io/security/cve-2026-47873
More from Spring Tools for Eclipse
8.3
CVE-2026-47882
Spring Boot DevTools remote secret generated with a non-cryptographic PRNG
8.0
CVE-2026-47858
live information startup mode is vulnerable for remote code execution
5.4
CVE-2026-59328
Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips
4.4
CVE-2026-59327
Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations
3.3
CVE-2026-59326
HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server