---
id: CVE-2026-114278
title: Unauthenticated Command Injection via kubeconfig Username in che-machine-exec
summary: >-
  The che-machine-exec service constructs a shell command by concatenating
  user-controlled input (the username and namespace fields from the /exec/init
  and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..."
  invocati…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: Eclipse Foundation
product: Eclipse Che
affected:
  - eclipse_che >= 7.0.0 <= 7.122.0
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T11:55:05.600Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114278'
references:
  - url: 'https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/359'
  - url: >-
      https://github.com/eclipse-che/che-machine-exec/commit/a78541c29e5f48fd59a49cf206bc0e507628bd23
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/476'
tags:
  - cve.org
ingestedAt: '2026-10-28T12:10:35.127Z'
---

## Overview

The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).

## Affected

- `eclipse_che >= 7.0.0 <= 7.122.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.