Description (CNA)
A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat OpenShift Dev Spaces (RHOSDS) 3.22 | unaffected 3.22.1-1763525702 before * |
| Red Hat / Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 | unaffected 3.23.1-1763508770 before * |
| Red Hat / Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 | unaffected 3.24.1-1763547630 before * |
CWE
CWE-306
References
- https://access.redhat.com/errata/RHSA-2025:22620
- https://access.redhat.com/errata/RHSA-2025:22623
- https://access.redhat.com/errata/RHSA-2025:22652
- https://access.redhat.com/security/cve/CVE-2025-12548
- https://bugzilla.redhat.com/show_bug.cgi?id=2408850
ADP enrichment
No English description supplied.
No references supplied.