# CVE-2026-47873: Spring Tools for Eclipse insecure port binding in Boot Dashboard Docker integration

Source: https://junglewise.ai/threats/cve-2026-47873-spring-tools-for-eclipse-insecure-port-binding-in-boot-dashboard  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-47873 · Severity: high · CVSS 8 · Published 2026-07-30

Spring Tools for Eclipse, a development environment for building Java applications, contains a security flaw in its Docker integration dashboard. The tool incorrectly exposes internal container control ports to the entire local network instead of keeping them private to the developer's own computer. This could allow unauthorized individuals on the same network to gain control over the development containers, potentially leading to data theft or unauthorized access to the developer's work environment.

Technologies: [Broadcom Spring Tools for Eclipse](https://junglewise.ai/threats/technologies/spring-tools-for-eclipse). Vendors: [Broadcom](https://junglewise.ai/threats/vendors/broadcom).

## Quick answers

**Is CVE-2026-47873 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47873 being exploited in the wild.

**How severe is CVE-2026-47873?** High severity, with a CVSS score of 8, published 30 July 2026.

**Which products and versions are affected?** Broadcom Spring Tools for Eclipse 5.2.0 and earlier.

**Is there a fix for CVE-2026-47873?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47873 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-47873?** Check whether you run Broadcom Spring Tools for Eclipse at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A network exposure vulnerability exists in the Spring Tools for Eclipse Boot Dashboard Docker integration. The component incorrectly binds container control ports to the 0.0.0.0 interface instead of 127.0.0.1 (loopback). This configuration allows any device on the same adjacent network to access these control ports. An attacker on the local network could potentially interact with the Docker containers managed by the IDE. The vulnerability affects versions 5.2.0 and earlier; users should update to a patched version to ensure ports are restricted to the local host.

## Affected products

- Spring Spring Tools for Eclipse 5.2.0 and earlier

## Timeline

- 2026-07-30: advisory: Advisory published by VMware/Spring

## References

- [https://spring.io/security/cve-2026-47873](https://spring.io/security/cve-2026-47873)

## Related threats

- [Spring Tools for Eclipse cleartext storage of DevTools secret](https://junglewise.ai/threats/cve-2026-59327-spring-tools-for-eclipse-cleartext-storage-of-devtools-secret)
- [Spring Boot language server credential disclosure in proxy logs](https://junglewise.ai/threats/cve-2026-59326-spring-boot-language-server-credential-disclosure-in-proxy-logs)
- [Spring Tools JMX remote code execution in live information mode](https://junglewise.ai/threats/cve-2026-47858-spring-tools-jmx-remote-code-execution-in-live-information-mode)