Github.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333

The impact of CVE-2025-12548 is severe. An attacker can gain complete control over user containers within the Eclipse Che environment, leading to data breaches, system compromise, and potential lateral movement within the Kubernetes cluster. Successful exploitation could result in the theft of sensitive credentials, modification of container contents, and disruption of development workflows. The unauthenticated nature of the vulnerability significantly broadens the attack surface, making it accessible to a wide range of malicious actors. This vulnerability shares similarities with other container escape vulnerabilities, highlighting the importance of robust container security practices.

Organizations utilizing Eclipse Che for software development and deployment, particularly those running it within Kubernetes environments, are at significant risk. Shared hosting environments or deployments with relaxed network security policies are especially vulnerable, as the unauthenticated nature of the vulnerability allows for easy exploitation.

• kubernetes / server:

kubectl get pods -l app=che-machine-exec -o jsonpath='{.items[*].status.containerStatuses[*].name}'

• kubernetes / server:

kubectl describe pod <pod_name> | grep -i 'che-machine-exec'

• kubernetes / server:

kubectl logs <pod_name> -c che-machine-exec -f | grep -i 'json-rpc'

1. 2026-01-13Disclosure

   disclosure

1. 予約済み2025-10-31
2. 公開日2026-01-13
3. 更新日2026-01-21
4. EPSS 更新日2026-03-23

The primary mitigation for CVE-2025-12548 is to upgrade to a version of Eclipse Che that includes the fix. Since a specific fixed version is not yet available, immediate action is required. As a temporary workaround, consider isolating the che-machine-exec service within a restricted network segment, limiting access to TCP port 3333 to only authorized clients. Implement strict network policies within your Kubernetes cluster to prevent unauthorized access to the service. Monitor Kubernetes audit logs for suspicious activity related to the che-machine-exec component. After upgrading, confirm the fix by attempting to trigger the vulnerable API endpoint and verifying that command execution is blocked.