Spring Tools CVE-2026-47873

Exploitation requires that the victim is actively running the Boot Dashboard Docker integration in Spring Tools for Eclipse (5.2.0 or earlier), which is the specific feature that publishes the container control port on 0.0.0.0 - this is the UI:R condition, since the port only exists while the developer has launched a container through this integration. The attacker must be on the same adjacent network segment as the developer's host (AV:A), not the broader internet, so exploitation is limited to shared LAN/Wi-Fi contexts and is prevented when the developer is on an isolated network, behind a host firewall restricting the port to loopback, or not using the Docker integration at all. No authentication is required (PR:N), and the underlying container control interface must be reachable and unauthenticated for the high impact to materialize.

The CVSS 3.1 base score is 8.0 (High) with vector AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The signals are mostly consistent: adjacent-network attack vector (AV:A) matches the 0.0.0.0 binding being reachable across the local network but not the full internet; low complexity and no privileges required lower the bar; UI:R reflects that a developer must have the Boot Dashboard Docker integration actively running for the port to exist. EPSS is not provided, KEV status is not listed (not actively exploited), and no POC is referenced, so real-world exploitation pressure is currently modest and opportunistic rather than mass-scale. The realistic risk is elevated on shared or untrusted developer networks (co-working spaces, corporate LANs, conference Wi-Fi) where an adjacent attacker can enumerate exposed Docker control ports; it is much lower for developers on isolated/home networks behind NAT. Note one point to verify: AV:A limits exposure to the local segment, so despite the High score this is not a remotely-internet-exploitable flaw unless the host is directly network-exposed.

A developer on a corporate or public Wi-Fi network launches a Spring Boot app in a container via the Boot Dashboard Docker integration, unknowingly publishing the container control port on 0.0.0.0. An attacker on the same subnet scans for the exposed port, connects without credentials, and interacts with the container control interface to read data or manipulate the running container. No public POC is referenced, but exploitation requires only standard network scanning tools.