CVE-2026-114278

CRITICAL 9.8

Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

CVSS Score

9.8

EPSS Score

0.0%

EPSS Percentile

0th

The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).

CWE	CWE-78
Vendor	eclipse foundation
Product	eclipse che
Published	Oct 28, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse foundation eclipse che

Be the first to know when new critical vulnerabilities affecting eclipse foundation eclipse che are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Eclipse Foundation / Eclipse Che

7.0.0 ≤ 7.122.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

gitlab.eclipse.org: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/359 github.com: https://github.com/eclipse-che/che-machine-exec/commit/a78541c29e5f48fd59a49cf206bc0e507628bd23 gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/476

Credits

bugbunny.ai.