CVE-2026-114278

Summary

The che-machine-exec service builds shell commands unsafely by directly embedding unescaped user input into a double-quoted sh -c invocation, enabling remote code execution when authentication is disabled (its default). Attackers can inject shell metacharacters via the username and namespace fields to execute arbitrary commands in targeted containers.

Exploitability

Exploitation is trivial for any network-reachable attacker since authentication is disabled by default and no input sanitization or escaping is performed.

Blast radius

Successful exploitation grants full remote code execution inside containers accessible to che-machine-exec, potentially compromising infrastructure, data, and downstream systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Eclipse Che version 8.59.0 or later, which addresses this issue by properly escaping user-provided inputs before shell command construction.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.