Eclipse Che che-machine-exec: OS command injection via username and namespace
Summary
The che-machine-exec service of Eclipse Che builds a shell command from the username and namespace fields of the /exec/init and /exec/config JSON endpoints without escaping them. With authentication disabled (the default), a network-reachable attacker can execute arbitrary commands through shell command substitution in containers that che-machine-exec can access. The CNA scores the flaw 9.8 (critical); VulDB scores it 7.3.
Affected
- Eclipse Che che-machine-exec 7.0.0 to 7.122.0 (inclusive), according to the CNA record
- Vulnerable condition: authentication disabled (default configuration)
Fixed in
Unknown. Fix commit a78541c adds input validation, but no fixed release is named in the sources.
Workaround
- Enable authentication on che-machine-exec.
- Do not expose the exec endpoints (JSON-RPC/WebSocket API) to untrusted networks; restrict access with NetworkPolicies, ingress rules or a reverse proxy.
- Restrict who can create workspaces in multi-tenant clusters.
- Note: the fix uses a blocklist of shell metacharacters; treat it as a patch to deploy, not a complete mitigation.
Exploitation
- No exploitation in the wild known.
- No public proof of concept or exploit found as of the latest sources (28 Oct 2026).
- EPSS: 0.9 %.
Our recommendation
- Check whether Eclipse Che with che-machine-exec is deployed, including in development environments.
- Enable authentication immediately and restrict network access to the exec endpoints.
- Monitor exec endpoint requests and unexpected commands in workspace containers.
- Plan an upgrade once Eclipse names a fixed release, and check the che-machine-exec version actually deployed.
- Check whether the earlier issue CVE-2025-12548 also applies to your deployment.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Fix commit a78541c (GitHub) github.com
- Eclipse CVE work item 476 gitlab.eclipse.org
- Eclipse vulnerability report 359 gitlab.eclipse.org
- VulDB 427962 vuldb.com
- OffSeq Radar threat entry radar.offseq.com
- Strix CVE-2026-114278 www.strix.ai
- Kodem CVE-2025-12548 (related issue) www.kodemsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:14.
Original description (NVD)
The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.