What’s Vulnerable › Vulnerabilities

CVE-2026-114278: Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-28 · updated 2026-10-28
• Weakness: CWE-78

Description

The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).

Summary

CVE-2026-114278 is a critical (CVSS 9.8) unauthenticated command injection in Eclipse Che's che-machine-exec service, which concatenates the user-controlled username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c command without escaping. Because authentication is disabled by default, any network-reachable attacker can use shell command substitution to achieve remote code execution in containers che-machine-exec can access. The flaw affects Eclipse Che from the Eclipse Foundation; it is not listed in CISA KEV and no exploitation has been confirmed. Apply the vendor's fixed release when available, and until then restrict network access to che-machine-exec and enable authentication.

تُعدّ CVE-2026-114278 ثغرة حقن أوامر حرجة (CVSS 9.8) في خدمة che-machine-exec ضمن Eclipse Che، إذ تُدمج الحقول username وnamespace التي يتحكم بها المستخدم من نقاط النهاية /exec/init و/exec/config في أمر sh -c مزدوج الاقتباس دون أي تهريب. ولأن المصادقة معطّلة افتراضياً، يمكن لأي مهاجم يستطيع الوصول إلى الشبكة استغلال استبدال أوامر الصدفة لتنفيذ تعليمات برمجية عن بُعد داخل الحاويات التي تصل إليها che-machine-exec. تتأثر منتجات Eclipse Che من مؤسسة Eclipse، والثغرة غير مدرجة في CISA KEV ولم يُؤكَّد استغلالها. طبّق الإصدار المُصلَح من المورّد عند توفره، وإلى حين ذلك قيّد الوصول الشبكي إلى che-machine-exec وفعّل المصادقة.

Affected products

• The Eclipse Foundation Eclipse Che: from 7.0.0 through 7.122.0

References

• https://github.com/eclipse-che/che-machine-exec/commit/a78541c29e5f48fd59a49cf206bc0e507628bd23
• https://gitlab.eclipse.org/security/cve-assignment/-/work_items/476
• https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/359

Get alerted when CVE-2026-114278 or the next vulnerability affects your stack