CVE-2025-12548

CRITICAL
2026-01-13 [email protected]
9.0
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch Released
Mar 31, 2026 - 21:13 nvd
Patch available
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 13, 2026 - 16:15 nvd
CRITICAL 9.0

Tags

Ssh Authentication Bypass Redhat

Description

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.

Analysis

Eclipse Che che-machine-exec exposes an unauthenticated JSON-RPC/WebSocket API on port 3333 that allows remote command execution and secret exfiltration from other users' developer workspace containers.

Technical Context

The che-machine-exec component exposes a JSON-RPC API over WebSocket on TCP 3333 without authentication (CWE-306). An attacker can execute commands in any user's workspace container, accessing SSH keys, tokens, and source code.

Affected Products

Eclipse Che (che-machine-exec component)

Remediation

Restrict port 3333 access. Apply Eclipse Che security updates. Audit workspace access logs.

Priority Score

45
Low Medium High Critical
KEV: 0
EPSS: +0.3
CVSS: +45
POC: 0

Vendor Status

Share

CVE-2025-12548 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy