CVE-2025-12548: Github.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333

Severity: critical (CVSS 9.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-13 · updated 2026-09-21
Weakness: CWE-306

Description

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.

Affected products

Red Hat OpenShift Dev Spaces (RHOSDS) 3.22: all versions — fixed in 3.22.1-1763525702
Red Hat OpenShift Dev Spaces (RHOSDS) 3.23: all versions — fixed in 3.23.1-1763508770
Red Hat OpenShift Dev Spaces (RHOSDS) 3.24: all versions — fixed in 3.24.1-1763547630

How to fix

Upgrade to a fixed version: Red Hat OpenShift Dev Spaces (RHOSDS) 3.22 3.22.1-1763525702; Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 3.23.1-1763508770; Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 3.24.1-1763547630. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-12548 or the next vulnerability affects your stack