Server-Side Request Forgery in Eclipse Che Dashboard API

CVE-2026-86590

What is CVE-2026-86590?

In specific versions of Eclipse Che, the dashboard backend's POST /dashboard/api/data/resolver endpoint improperly handles user-supplied URLs, allowing an authenticated user to exploit a server-side request forgery (SSRF). The vulnerability permits the retrieval of sensitive information from internal network addresses, including the cloud instance metadata service and internal Kubernetes services. This occurs due to a lack of appropriate host filtering and an oversight in the enforcement of the operator-configured allowlist. The issue was addressed in version 7.122.0 by implementing measures such as private-address blocking, prevention of IPv4-mapped IPv6 bypass, strict operator allowlist enforcement, and disabling HTTP redirects in outbound requests.

References