CVE-2026-86671: Eclipse Che 7.29.0 to before 7.123.0

Affected technology

Eclipse Che · 7.29.0 to before 7.123.0
Eclipse Foundation

Description’s affected range: versions 7.29.0 and later

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Any authenticated Che user can read arbitrary local files via the file:// scheme (including the pod's Kubernetes service-account token at `file:///var/run/secrets/kubernetes.io/serviceaccount/token`), reach internal HTTP services and cloud instance metadata endpoints (169.254.169.254), and have their stored SCM personal access token attached as an `Authorization` header to a host of their choosing. Vendor/CNA’s CVSS 4.0 assessment (base score 8.4/10) rates confidentiality impact as high; integrity and availability impact as none.