Loading vulnerability…
Unauthenticated JDWP and JMX port exposure in Spring Tools Boot Dashboard Docker integration
CVE-2026-47873 affects the Boot Dashboard Docker integration in Spring Tools for Eclipse 5.2.0 and earlier. The integration publishes unauthenticated JDWP debugging and JMX container control ports on all host network interfaces instead of restricting access to loopback. This exposes debugging and management interfaces to other systems that can reach the host, potentially compromising confidentiality, integrity, and availability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Network-reachable systems may gain unauthorized access to unauthenticated container debugging and management interfaces. Exploitation could compromise confidentiality, integrity, and availability, although specific exploitation outcomes are not established. Evaluated, currently supported F5 products are unaffected; that assessment excludes releases beyond End of Technical Support.
If you can’t patch tonight, do this now.
Upgrade to the fixed release. No additional mitigation steps are specified for affected Spring Tools installations.
Patch, then assume compromise.
Upgrade Spring Tools for Eclipse to version 5.3.0 or later, which addresses the Boot Dashboard Docker port-binding behavior.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.