9.0
Critical
CVE-2025-12548 A flaw was found in Eclipse Che che-machine-exec
Description
A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.22 3.22 | earliest → < 3.22.1-1763525702 | 3.22.1-1763525702 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.23 3.23 | earliest → < 3.23.1-1763508770 | 3.23.1-1763508770 |
| Red Hat OpenShift Dev Spaces (RHOSDS) 3.24 3.24 | earliest → < 3.24.1-1763547630 | 3.24.1-1763547630 |
| Red Hat OpenShift Dev Spaces | Versions not published |
References
- RHSA-2025:22620 access.redhat.com
- RHSA-2025:22623 access.redhat.com
- RHSA-2025:22652 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2408850 bugzilla.redhat.com
Timeline
- Published
- Last modified