{"id":"CVE-2026-114278","published":"2026-10-28T12:17:39.773","lastModified":"2026-10-28T15:24:56.033","description":"The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c \"echo \"...\" > ...\" invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-che/che-machine-exec/commit/a78541c29e5f48fd59a49cf206bc0e507628bd23","tags":[]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/476","tags":[]},{"url":"https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/359","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-che/che-machine-exec/commit/a78541c29e5f48fd59a49cf206bc0e507628bd23","tags":[]}],"hasPoc":true,"ai":{"summary":"The che-machine-exec service builds shell commands unsafely by directly embedding unescaped user input into a double-quoted sh -c invocation, enabling remote code execution when authentication is disabled (its default). Attackers can inject shell metacharacters via the username and namespace fields to execute arbitrary commands in targeted containers.","exploitability":"Exploitation is trivial for any network-reachable attacker since authentication is disabled by default and no input sanitization or escaping is performed.","blast_radius":"Successful exploitation grants full remote code execution inside containers accessible to che-machine-exec, potentially compromising infrastructure, data, and downstream systems.","remediation":"Upgrade to Eclipse Che version 8.59.0 or later, which addresses this issue by properly escaping user-provided inputs before shell command construction.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","shell-injection","auth-bypass","web","container"],"model":"garnet-coder","analyzedAt":"2026-10-29T08:41:36.765Z"}}