Spring Tools Docker Port Exposure on All Network Interfaces

CVE-2026-47873 is a configuration vulnerability in Spring Tools for Eclipse versions 5.2.0 and earlier, where the Boot Dashboard Docker integration exposes container control ports to all network interfaces (0.0.0.0) instead of restricting access to loopback (127.0.0.1). This creates a critical security gap for development environments, particularly those connected to shared networks or cloud infrastructure. Attackers on the same network segment can directly access Docker daemon APIs without authentication, enabling container manipulation, escape attempts, and lateral movement. Development teams using Spring Tools for containerized application testing are directly affected, and the risk compounds in corporate networks or CI/CD environments where multiple developers share infrastructure.

While this CVE does not map to specific MITRE ATT&CK techniques, the underlying attack pattern falls within lateral movement and privilege escalation domains. Casky's platform would detect suspicious Docker API interactions by analyzing network communication patterns, unauthorized container lifecycle commands, and anomalous API access attempts. Practitioners would observe findings related to unintended network exposure, insecure service configuration, and potential infrastructure as code misconfigurations. The 0 matching Casky skills reflects the absence of active exploitation signatures, but practitioners should leverage Casky's extensible framework to map this vulnerability to T1021 (Remote Service Session Initiation) and T1566 (Phishing) if weaponized through supply chain attacks targeting development tool installations.