che-machine-exec EUVD-2026-112026

che-machine-exec must be running with authentication disabled - which the description states is its default - and be network-reachable to the attacker, who then supplies shell metacharacters (command substitution via $(...) or backticks) in the username or namespace field of the /exec/init or /exec/config JSON endpoints; code executes in whatever containers the service is configured to access. Limiting factors: if an operator has enabled authentication (non-default) the unauthenticated path closes, and exposure is bounded by whether the service is reachable from untrusted networks and by the set of containers che-machine-exec is authorized to reach.

All severity signals point the same direction and reinforce a high-priority verdict. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes unauthenticated, network-reachable, low-complexity exploitation with high confidentiality, integrity and availability impact (CVSS 9.8), and this is corroborated by the description: che-machine-exec ships with authentication disabled by default, so a network-reachable attacker needs no credentials. The vuln.today decision label is act_now, and CWE-78 plus the 'RCE'/'Command Injection' tags match the mechanism shown in the fix commit (unescaped username/namespace concatenated into an sh -c string). Countervailing: there is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation yet - the urgency rests on the trivial, unauthenticated, default-configuration RCE primitive rather than on observed attacks. The real mitigating variable is deployment exposure: the PR:N rating is only valid in the default auth-disabled mode, so environments that enabled authentication or that do not expose the service to untrusted networks face materially lower real-world risk than the 9.8 implies. This is a genuine priority where the service is network-exposed in its default state, not a high-CVSS-but-low-real-risk issue.

An attacker who can reach a che-machine-exec instance running in its default authentication-disabled mode sends a crafted POST to /exec/init or /exec/config with a username or namespace value containing shell command substitution such as $(id) or backticks. Because the value is concatenated unescaped into an sh -c "echo "..." > ..." invocation, the substitution executes, yielding remote code execution in the containers che-machine-exec is configured to access. No public exploit is identified in the supplied data, but the fix commit confirms the exact injectable fields and sink.