External risk intelligence

Eclipse Che che-machine-exec Remote Code Execution via Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-114278

The service operates as a network-reachable endpoint that functions by default with authentication disabled. It is designed to handle execution requests in containers, making it a pre-authentication internet-facing service in common deployments where such machine execution or management endpoints are exposed.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the che-machine-exec service, which could allow unauthorized remote code execution. The issue arises from how user-provided input is handled when constructing shell commands, particularly when the service is accessible over the network without authentication. This could potentially lead to a compromise of the environments managed by this service.

Service allows remote code execution.
Affects unauthenticated, network-accessible deployments.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to network-accessible endpoints. The che-machine-exec service, when authentication is disabled, will process user-supplied usernames and namespaces to construct shell commands. By leveraging shell command substitution, an attacker can inject arbitrary commands, leading to remote code execution within the containers managed by the service.

No authentication required for access.
User input is directly used in shell commands.
Remote code execution on containers.

Live Threat

Current exploitation, exposure, and threat context

When authentication is disabled, a network-reachable attacker could execute arbitrary commands on containers managed by the che-machine-exec service by sending specially crafted input to the username or namespace fields. This could affect system data and service behavior within those containers.

Container command execution.
Unauthenticated network input.
Compromise of containerized workloads.

Operational Fix

Recommended remediation, mitigation, and detection steps

The che-machine-exec service, by default, accepts unauthenticated network requests and constructs shell commands using user-controlled input without proper escaping, leading to remote code execution. This critical vulnerability is likely to impact application owners or platform teams managing containerized environments. The first practical step is to identify all instances of this service, confirm their network reachability and business criticality, and then plan remediation based on the assessed risk, which may involve coordinating with vendors if the service is part of a third-party solution.

Application and platform teams own remediation.
Verify service reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the che-machine-exec service used for?

Part of the Eclipse Che ecosystem, che-machine-exec is a component designed to facilitate command execution within containerized environments. It acts as an interface allowing the platform to manage and interact with workloads by running operations inside specific containers, effectively serving as an execution bridge for containerized development or management tasks.

What does CVE-2026-114278 mean?

This vulnerability is an instance of Improper Neutralization of Special Elements used in an OS Command, known as CWE-78 or command injection. It occurs because the service takes user-provided data, such as usernames or namespace strings, and inserts them directly into a system command shell without sanitizing them. This allows an attacker to inject their own malicious commands, which the system then executes.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending a specially crafted JSON request to the service's /exec/init or /exec/config endpoints. By embedding shell command substitution syntax like $(...) or backticks into the username or namespace fields, the attacker forces the underlying shell to run those injected commands. Normal service requests that do not include shell-sensitive characters or syntax do not activate this flaw.

Is my deployment at risk from this CVE?

According to Halo Surface Signal, this vulnerability is very likely to pose a risk to deployments where the service is network-reachable and operates with authentication disabled by default. If your instance is accessible over a network without requiring valid user credentials, it is vulnerable. Internal-only deployments that are strictly isolated from network access face a lower risk profile compared to internet-facing services.

What are the first steps to address this issue?

Begin by auditing your infrastructure to locate all active instances of che-machine-exec. Verify whether these instances are currently exposed to your network and assess their business criticality. Once identified, prioritize these systems for remediation, which involves ensuring authentication is enforced and coordinating with the vendor or platform maintainers for official security patches or configuration updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.