In this article
If your team self-hosts Eclipse Che, the open-source cloud development workspace platform, update its che-machine-exec component. A flaw tracked as CVE-2026-114278 lets anyone who can reach the service run commands inside workspace containers when its authentication is off, which the CVE record says is the default. It isn’t in CISA’s Known Exploited Vulnerabilities catalog.
What happened
The flaw: According to the CVE record from the Eclipse Foundation, che-machine-exec builds a shell command from the username and namespace fields sent to its /exec/init and /exec/config endpoints without escaping them. When authentication is disabled, which is its default, a network-reachable attacker can inject commands and run code in any container the service can access. Eclipse rates it 9.8 (critical).
Who is affected: Eclipse Che 7.0.0 through 7.122.0, per the CVE record.
The fix: Commit a78541c (“Validate certain parameters used in shell commands”), written September 14 and committed September 17, 2026. The first che-machine-exec tag that includes it is 7.123.0. Eclipse Che 7.123.0, released October 6, ships it: Che’s default editor image, che-code 7.123.0, is built from che-machine-exec 7.123.0. Che 7.124.0, released October 21, is the latest.
Exploitation: No source we checked reports attacks, and the flaw isn’t in CISA’s KEV catalog.
Why it matters
Workspace containers often hold source code, cloud credentials and tokens. Command execution there can mean a stolen codebase or a foothold in your cluster, and with authentication off by default, the only barrier may be who can reach the service on the network.
What to do
Our advice, based on the CVE record and the fix commit:
- Update Eclipse Che so che-machine-exec is 7.123.0 or later.
- Don’t treat authentication as a substitute for updating. che-machine-exec’s USE_BEARER_TOKEN setting is off by default, and Eclipse’s vulnerability report says that with it on, the flaw can still be exploited by any logged-in user.
- Make sure che-machine-exec isn’t reachable from the internet or from untrusted pods; restrict it with network policies.
- Review workspace containers for processes, files or outbound connections you don’t recognize, and rotate any secrets they held if you find something.
Sources
| Source | What it confirms | Link |
|---|---|---|
| GitHub advisory GHSA-rq96-f9wc-rppm (unreviewed, Oct 28, 2026) | Flaw description, CVSS 3.1 9.8, CWE-78, fix commit reference | https://github.com/advisories/GHSA-rq96-f9wc-rppm |
| CVE-2026-114278 record (Eclipse Foundation, CNA) | Description, affected 7.0.0 through 7.122.0, CVSS 3.1 9.8 | https://www.cve.org/CVERecord?id=CVE-2026-114278 |
| NVD CVE-2026-114278 | Published Oct 28, 2026; Eclipse’s 9.8 score (NVD not yet scored) | https://nvd.nist.gov/vuln/detail/CVE-2026-114278 |
| che-machine-exec commit a78541c | The fix, authored Sep 14 and committed Sep 17, 2026 | https://github.com/eclipse-che/che-machine-exec/commit/a78541c29e5f48fd59a49cf206bc0e507628bd23 |
| che-machine-exec tags | 7.123.0 is the first tag containing the fix | https://github.com/eclipse-che/che-machine-exec/tags |
| CISA KEV catalog (version 2026.10.27) | CVE not listed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |
| Eclipse Che 7.123.0 and 7.124.0 releases | 7.123.0 released Oct 6, 2026; 7.124.0 (Oct 21) is the latest | https://github.com/eclipse-che/che/releases/tag/7.123.0 |
| che-operator 7.123.0 editor definition and che-code 7.123.0 build file | Che 7.123.0’s default editor che-code 7.123.0 is built from che-machine-exec 7.123.0 | https://github.com/che-incubator/che-code/blob/7.123.0/build/dockerfiles/assembly.Dockerfile#L15 |
| Eclipse vulnerability report #359 | Auth off by default (USE_BEARER_TOKEN=false); with it on, still exploitable by logged-in users | https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/359 |
| che-machine-exec cfg/cfg.go | USE_BEARER_TOKEN / –use-bearer-token, default false | https://github.com/eclipse-che/che-machine-exec/blob/7.123.0/cfg/cfg.go#L68-L79 |
Last checked: Oct 28, 2026, 10:20 p.m. Manila (UTC+8). Method: We read the CVE record, GitHub advisory, NVD record and Eclipse’s vulnerability report, confirmed the fix commit and the tags containing it in the che-machine-exec repo, traced Che 7.123.0’s editor image to che-machine-exec 7.123.0 in the che-operator and che-code build files, and checked CISA’s KEV catalog. How we work
Updates
- Oct 29, 2026, 7:05 a.m. Manila: First published.
Spotted an error? See our corrections policy and tell us.
