CVE-2026-86590 Server-side request forgery in Eclipse Che
Authenticated users can exploit an SSRF vulnerability in Eclipse Che to read internal network resources and cloud metadata, bypassing security controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86590?
CVE-2026-86590 is a medium-severity server-side request forgery vulnerability in Eclipse Che, published on 8 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery (SSRF) to read responses from internal network addresses, including the cloud instance metadata service (169.254.169.254), loopback interfaces, RFC-1918 private ranges, and in-cluster Kubernetes services. The operator-configured allowlist (spec.devEnvironments.allowedSources.urls) is not consulted. The vulnerability is fixed in version 7.122.0, which adds private-address blocking, IPv4-mapped IPv6 bypass prevention, operator allowlist enforcement, and disables HTTP redirects on the outbound request.
Weakness: CWE-918
Which versions are affected by CVE-2026-86590?
How do I fix CVE-2026-86590?
No fix has been published for CVE-2026-86590 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-86590 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-86590 exists.
Sources
Also known as GHSA-7c8p-h44p-ww4q.