CVE-2026-47873: Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-30 · updated 2026-10-23
Weakness: CWE-1327

Description

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

Affected products

Spring Tools for Eclipse: before 5.3.0 — fixed in 5.3.0

How to fix

Upgrade to a fixed version: Spring Tools for Eclipse 5.3.0. Check the vendor advisory for mitigations.

References

https://spring.io/security/cve-2026-47873

Get alerted when CVE-2026-47873 or the next vulnerability affects your stack