CVE-2026-86590 Details
Description
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery (SSRF) to read responses from internal network addresses, including the cloud instance metadata service (169.254.169.254), loopback interfaces, RFC-1918 private ranges, and in-cluster Kubernetes services. The operator-configured allowlist (spec.devEnvironments.allowedSources.urls) is not consulted. The vulnerability is fixed in version 7.122.0, which adds private-address blocking, IPv4-mapped IPv6 bypass prevention, operator allowlist enforcement, and disables HTTP redirects on the outbound request.
A server-side request forgery (SSRF) vulnerability has been identified in the Eclipse Che dashboard backend, specifically in versions 7.79.0 through 7.121.0. The issue arises in the POST /dashboard/api/data/resolver endpoint, where user-supplied URLs are sent in outbound HTTP GET requests without proper host validation. This vulnerability allows authenticated users to access internal network resources, including cloud instance metadata services, loopback interfaces, private IP ranges, and in-cluster Kubernetes services. Notably, the operator's allowlist for source URLs is not applied in this context.
Users can update to Eclipse Che version 7.122.0 or later, which addresses this vulnerability by implementing private address blocking, preventing IPv4-mapped IPv6 bypasses, enforcing operator allowlists, and disabling HTTP redirects for outbound requests.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/617 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/eclipse-che/che-dashboard/pull/1655 | [email protected] | Source CodeVendor |
| https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/617 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse Che | >= 7.53.0, <= 7.121.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | New CVE Received | [email protected] |