CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
CriticalCVSS 9.8
EPSS 0.90%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse Foundation Eclipse Che | >= 7.0.0, <= 7.122.0 | No fix listed |
| redhat/devspaces/code-rhel9(Red Hat:openshift_devspaces:3) | All versions | No fix listed |
| redhat/devspaces/jetbrains-ide-rhel9(Red Hat:openshift_devspaces:3) | All versions | No fix listed |
References
- gitlab.eclipse.org exploit
- github.com
- gitlab.eclipse.org
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2562812 issue-tracking
- www.cve.org
- nvd.nist.gov