{"id":"CVE-2026-114278","kind":"vulnerability","aliases":["CVE-2026-114278"],"related":[],"title":"Eclipse Che machine-exec: unescaped username lets network attackers run commands","description":"The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c \"echo \"...\" > ...\" invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).","summary":"The che-machine-exec service builds a shell command by pasting the username and namespace fields from its /exec/init and /exec/config endpoints into a sh -c string without escaping. With authentication disabled, which is the default, a network attacker can use shell command substitution to run code in containers that che-machine-exec can reach.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","eclipse-che","kubernetes","other","self-hosted"],"not_affected_if":["auth-required","network-isolated"],"how_to_check":"- Check whether che-machine-exec is deployed and reachable from the network, for example `kubectl get pods -A | grep che-machine-exec`\n- Check whether authentication is enabled on the service; the sources say it is disabled by default, so review the deployment configuration for its auth setting\n- unknown whether a specific version is vulnerable, as the sources do not list affected versions","fix":"- unknown: the sources do not name a patched version or vendor fix\n- Enable authentication on che-machine-exec until a fixed release is confirmed\n- Restrict network access to the che-machine-exec endpoints to trusted sources","status":"open","published_at":"2026-10-28T12:17:39+00:00","first_seen_at":"2026-10-28T12:32:51+00:00","triaged_at":"2026-10-28T12:33:46+00:00","updated_at":"2026-10-28T12:33:46+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-28T12:33:46Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a patched version or vendor fix\n- Enable authentication on che-machine-exec until a fixed release is confirmed\n- Restrict network access to the che-machine-exec endpoints to trusted sources","reach":"internet","title":"Eclipse Che machine-exec: unescaped username lets network attackers run commands","impact":"high","summary":"The che-machine-exec service builds a shell command by pasting the username and namespace fields from its /exec/init and /exec/config endpoints into a sh -c string without escaping. With authentication disabled, which is the default, a network attacker can use shell command substitution to run code in containers that che-machine-exec can reach.","category":"other","nicknames":[],"who_cares":["eclipse-che","kubernetes","self-hosted","containers"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs arbitrary commands inside reachable workspace containers over the network","analyst_note":"Find the vendor advisory or fixed release version for che-machine-exec and the affected version range; the NVD entry alone does not give them.","how_to_check":"- Check whether che-machine-exec is deployed and reachable from the network, for example `kubectl get pods -A | grep che-machine-exec`\n- Check whether authentication is enabled on the service; the sources say it is disabled by default, so review the deployment configuration for its auth setting\n- unknown whether a specific version is vulnerable, as the sources do not list affected versions","needs_analyst":true,"not_affected_if":["auth-required","network-isolated"],"who_is_affected":"Teams running Eclipse Che workspaces, or any deployment of che-machine-exec, where the service is reachable over the network and authentication is off. Installations with authentication enabled, or where the service is not reachable from untrusted networks, are less exposed. The sources do not say which Che releases are affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000677,"input_tokens":3371,"output_tokens":679,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-114278':15A,18A '-2026':14A,17A '/exec/config':49B,110C '/exec/init':47B,108C 'access':156C 'achiev':143C 'attack':10A,67B,141C 'authent':59B,133C 'backtick':162C 'build':34B 'c':54B,119C 'che':2A,22B,30B,80B,87C,127C,150C 'che-machine-exec':29B,79B,86C,126C,149C 'code':75B,145C 'command':12A,37B,71B,94C,159C 'concaten':96C 'configur':154C 'construct':91C 'contain':19B,77B,148C 'control':99C 'cve':13A,16A 'default':64B,136C 'disabl':60B,134C 'doubl':116C 'double-quot':115C 'echo':120C 'eclips':1A,21B 'eclipse-ch':20B 'endpoint':50B,112C 'escap':57B,124C 'exec':5A,32B,82B,89C,129C,152C 'execut':146C 'field':44B,105C 'host':27B 'input':100C 'invoc':121C 'json':111C 'kubernet':23B 'let':8A 'machin':4A,31B,81B,88C,128C,151C 'machine-exec':3A 'namespac':43B,104C 'network':9A,66B,139C 'network-reach':138C 'past':39B 'quot':117C 'reach':84B 'reachabl':140C 'remot':144C 'run':11A,74B,131C 'self':26B 'self-host':25B 'servic':33B,90C 'sh':53B,118C 'shell':36B,70B,93C,158C 'string':55B 'substitut':72B,160C 'unescap':6A 'use':69B 'user':98C 'user-control':97C 'usernam':7A,41B,102C 'via':157C 'without':56B,122C","nicknames":[],"mitigations":[],"who_affected":"Teams running Eclipse Che workspaces, or any deployment of che-machine-exec, where the service is reachable over the network and authentication is off. Installations with authentication enabled, or where the service is not reachable from untrusted networks, are less exposed. The sources do not say which Che releases are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T12:17:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"emo@eclipse.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114278","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114278","severity":null,"published_at":"2026-10-28T12:17:39+00:00","modified_at":"2026-10-28T12:17:39+00:00","first_seen_at":"2026-10-28T12:32:51+00:00","fetched_at":"2026-10-28T12:32:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}