CVE-2020-10689

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-04-03 · updated 2026-06-17
Weakness: CWE-862

Description

A flaw was found in the Eclipse Che up to version 7.8.x, where it did not properly restrict access to workspace pods. An authenticated user can exploit this flaw to bypass JWT proxy and gain access to the workspace pods of another user. Successful exploitation requires knowledge of the service name and namespace of the target pod.

Affected products

The Eclipse Foundation Eclipse Che: before 7.9.0 — fixed in 7.9.0

How to fix

Upgrade to a fixed version: The Eclipse Foundation Eclipse Che 7.9.0. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10689
https://github.com/eclipse/che/issues/15651
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10689
https://github.com/eclipse/che/issues/15651

Get alerted when CVE-2020-10689 or the next vulnerability affects your stack