What is the CVSS score of CVE-2026-47873?

CVE-2026-47873 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Spring Tools are affected by CVE-2026-47873?

Spring Tools for Eclipse versions 5.2.0 and earlier expose Docker container management ports to all network segments when developers activate the Boot Dashboard feature, allowing unauthenticated…

How to fix or mitigate CVE-2026-47873?

Within 24 hours, conduct an audit of all development machines to identify those running Spring Tools for Eclipse versions 5.2.0 or earlier with the Boot Dashboard Docker integration feature enabled, documenting the count and locations of each affected system. Within 7 days, implement interim controls by either disabling the Docker integration feature entirely on affected installations or restricting network access to these development workstations to internal-only connectivity through VPN and segmented networks-no vendor-released patch identified at time of analysis makes these controls mandatory. Within 30 days, monitor the VMware/Broadcom security advisory for patch availability and establish an immediate deployment process to upgrade all affected systems to the patched version once released, validating the fix addresses the network exposure vulnerability.

Spring Tools CVE-2026-47873

EUVD-2026-50972 HIGH

Binding to an Unrestricted IP Address (CWE-1327)

2026-07-30 vmware

GHSA-ph62-g3gp-mmvr

Java Information Disclosure Docker Spring Spring Tools For Eclipse

8.0

CVSS 3.1 · Vendor: vmware

Severity by source

Vendor (vmware) PRIMARY

8.0 HIGH

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Adjacent network (0.0.0.0 reachable only on local segment), no privileges, but the developer must be running the Docker integration (UI:R); unauthenticated container control yields high C/I/A.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vmware).

CVSS VectorVendor: vmware

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 08:30 vuln.today

CVE Published

Jul 30, 2026 - 05:23 cve.org

HIGH 8.0

DescriptionCVE.org

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier

Articles & Coverage 3

News 3 New Docker Vulnerabilities - 1 Critical, 2 High Severity Jul 31, 2026 News 3 New Java Vulnerabilities - 3 High Severity Jul 31, 2026 News 3 New Docker Vulnerabilities - 3 High Severity, 1 With POC Jul 30, 2026

AnalysisAI

Network exposure of Docker container control ports in Spring Tools for Eclipse (versions 5.2.0 and earlier) occurs because the Boot Dashboard Docker integration binds these ports to 0.0.0.0 (all interfaces) instead of loopback. Any attacker on the same network segment as a developer running the integration can reach the container control interface without authentication, yielding high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the flaw is trivially triggered once a developer starts the affected feature.

Technical ContextAI

The affected component is the Boot Dashboard, an Eclipse IDE view in Spring Tools that lets developers launch and manage Spring Boot applications, including running them inside Docker containers. When the Docker integration starts a container, it maps the container's control/management port to the host. The defect is an insecure network binding: the port is published on 0.0.0.0 (every host interface) rather than 127.0.0.1 (loopback), so a service intended only for the local developer becomes reachable across the LAN. CPE cpe:2.3:a:spring:spring_tools_for_eclipse identifies the affected product as the Eclipse-based Spring Tools distribution. No CWE was assigned in the input, but the root cause maps to the CWE-1327 'Binding to an Unrestricted IP Address' / CWE-668 'Exposure of Resource to Wrong Sphere' class, and the vendor tags it as Information Disclosure.

RemediationAI

Upgrade Spring Tools for Eclipse to a release later than 5.2.0 as directed by the vendor advisory at https://spring.io/security/cve-2026-47873; a fixed version is indicated by the '5.2.0 and earlier' affected range but the exact patched build number is not stated in the available data, so confirm it against the advisory before deploying. Patch available per vendor advisory. Until upgraded, avoid using the Boot Dashboard Docker integration on untrusted or shared networks, or run affected workloads only while on an isolated/loopback-only network; developers can also add a host firewall rule that blocks inbound connections to the published Docker container control ports from all sources except 127.0.0.1, which restores loopback-only intent at the cost of blocking any legitimate remote access to those containers. Binding-level workarounds within the IDE are limited because the insecure 0.0.0.0 binding is set by the integration itself, making the host firewall the most reliable stopgap.