Executive brief
Spring Tools for Eclipse, a development environment for building Java applications, contains a security flaw in its Docker integration dashboard. The tool incorrectly exposes internal container control ports to the entire local network instead of keeping them private to the developer's own computer. This could allow unauthorized individuals on the same network to gain control over the development containers, potentially leading to data theft or unauthorized access to the developer's work environment.
Technical details
A network exposure vulnerability exists in the Spring Tools for Eclipse Boot Dashboard Docker integration. The component incorrectly binds container control ports to the 0.0.0.0 interface instead of 127.0.0.1 (loopback). This configuration allows any device on the same adjacent network to access these control ports. An attacker on the local network could potentially interact with the Docker containers managed by the IDE. The vulnerability affects versions 5.2.0 and earlier; users should update to a patched version to ensure ports are restricted to the local host.
Affected products
- Spring Spring Tools for Eclipse 5.2.0 and earlier
Timeline
- 2026-07-30: advisory: Advisory published by VMware/Spring