Remote Code Execution Vulnerability in Eclipse Che Machine Exec Service

CVE-2026-114278

What is CVE-2026-114278?

The Eclipse Che Machine Exec service contains a vulnerability that allows an unauthenticated attacker to execute arbitrary shell commands. By exploiting this issue, which arises from the improper handling of user-controlled input, an attacker can concatenate input fields into shell command invocations without escaping, enabling remote code execution on the containers accessed by the service. This situation is particularly dangerous as it motivates possible exploitation through command substitution techniques, thereby compromising the security of the system.

References