CVE-2026-114278 Details

A command injection vulnerability has been identified in the Eclipse Che che-machine-exec service, affecting versions 7.0.0 through 7.122.0. The vulnerability arises because the service constructs shell commands by directly concatenating user-controlled input from the kubeconfig username and namespace fields into a shell command execution invocation, without any proper escaping. This flaw is particularly critical as it allows for remote code execution in workspace containers, where the che-machine-exec is configured to operate, by exploiting shell command substitution features. The issue is exacerbated by the fact that authentication is disabled by default, leaving the service open to exploitation by any network-reachable attacker.

Users are advised to update to Eclipse Che version 7.123.0 or later, where this vulnerability has been addressed.