CVE-2026-114278 Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114278?
CVE-2026-114278 is a critical vulnerability in Eclipse Che, published on 28 Oct 2026.
Official description
The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).
Weakness: CWE-78
Which versions are affected by CVE-2026-114278?
How do I fix CVE-2026-114278?
No fix has been published for CVE-2026-114278 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114278 being exploited?
There is no known exploitation of CVE-2026-114278 in the wild and no public exploit code.
Sources
Also known as GHSA-rq96-f9wc-rppm.