Live › vulnerability › CVE-2026-114278
Go to dashboardThe che-machine-exec service builds a shell command by pasting the username and namespace fields from its /exec/init and /exec/config endpoints into a sh -c string without escaping. With authentication disabled, which is the default, a network attacker can use shell command substitution to run code in containers that che-machine-exec can reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 12:32 UTC. All times on this page are UTC.
Teams running Eclipse Che workspaces, or any deployment of che-machine-exec, where the service is reachable over the network and authentication is off. Installations with authentication enabled, or where the service is not reachable from untrusted networks, are less exposed. The sources do not say which Che releases are affected.
No product ranges from the sources yet.
kubectl get pods -A | grep che-machine-execEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).
This page as .md · .json · in your agent: get_signal("CVE-2026-114278")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.