---
id: "CVE-2026-114278"
kind: "vulnerability"
aliases: ["CVE-2026-114278"]
title: "Eclipse Che machine-exec: unescaped username lets network attackers run commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["containers", "eclipse-che", "kubernetes", "other", "self-hosted"]
not_affected_if: ["auth-required", "network-isolated"]
published_at: "2026-10-28T12:17:39+00:00"
first_seen_at: "2026-10-28T12:32:51+00:00"
updated_at: "2026-10-28T12:33:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114278", "first_seen_at": "2026-10-28T12:32:51+00:00"}]
---

# Eclipse Che machine-exec: unescaped username lets network attackers run commands

The che-machine-exec service builds a shell command by pasting the username and namespace fields from its /exec/init and /exec/config endpoints into a sh -c string without escaping. With authentication disabled, which is the default, a network attacker can use shell command substitution to run code in containers that che-machine-exec can reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether che-machine-exec is deployed and reachable from the network, for example `kubectl get pods -A | grep che-machine-exec`
- Check whether authentication is enabled on the service; the sources say it is disabled by default, so review the deployment configuration for its auth setting
- unknown whether a specific version is vulnerable, as the sources do not list affected versions

## Fix

- unknown: the sources do not name a patched version or vendor fix
- Enable authentication on che-machine-exec until a fixed release is confirmed
- Restrict network access to the che-machine-exec endpoints to trusted sources

## Timeline

- 2026-10-28T12:32:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114278

## From the sources

The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_