Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Eclipse Che can run attacker code via unescaped username

CVE-2026-114278 · published 7 days ago
Summary

The che-machine-exec component of Eclipse Che builds a shell command using the username and namespace values it receives, without cleaning them. If authentication is turned off (the default setting), anyone who can reach the service over the network can inject malicious commands and take control of containers that Che accesses. Enable authentication or apply the provided patch to stop this remote code execution risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
eclipse foundation eclipse che <= 7.122.0
Original advisory text
Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published28 Oct 2026
Updated3 Nov 2026
First seen28 Oct 2026
Sources
CVE-2026-114278 · NVD
CVE-2026-114278 · MITRE
CVE-2026-114278 · OSV
Track software like this
Free during beta