# CVE-2025-12548: Eclipse Che che-machine-exec unauthenticated remote code execution

Source: https://junglewise.ai/threats/cve-2025-12548-eclipse-che-che-machine-exec-unauthenticated-remote-code  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-12548 · Severity: critical · CVSS 9 · Published 2026-01-13

Eclipse Che is a development environment platform used by organizations to provide developers with cloud-based workspaces. A critical vulnerability in its che-machine-exec component allows unauthenticated attackers to execute arbitrary commands and steal secrets (SSH keys, tokens) from developer workspace containers by exploiting an exposed JSON-RPC API, potentially compromising developer credentials and sensitive data across multiple users.

Technologies: [Eclipse Che](https://junglewise.ai/threats/technologies/che). Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2025-12548 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12548 being exploited in the wild.

**How severe is CVE-2025-12548?** Critical severity, with a CVSS score of 9, published 13 January 2026.

**Which products and versions are affected?** Eclipse Che affected versions prior to fix in Red Hat OpenShift Dev Spaces 3.22.1.

**Is there a fix for CVE-2025-12548?** A patch was published on 2025-12-02: Fix released in Red Hat OpenShift Dev Spaces 3.22.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-12548 attacked?** It is attacked over the network.

**Am I affected by CVE-2025-12548?** Check whether you run Eclipse Che at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an unauthenticated remote code execution flaw in Eclipse Che's che-machine-exec component, stemming from an exposed JSON-RPC/WebSocket API listening on TCP port 3333 without proper authentication. An unauthenticated remote attacker can directly interact with this API to execute arbitrary commands within Developer Workspace containers and exfiltrate secrets including SSH keys and authentication tokens stored in other users' containers. The attack vector is network-based and requires no authentication or user interaction. Red Hat addressed this in OpenShift Dev Spaces 3.22.1 released on 2025-12-02.

## Affected products

- Eclipse Che affected versions prior to fix in Red Hat OpenShift Dev Spaces 3.22.1

## Timeline

- 2025-12-02: disclosed: Red Hat security advisory RHSA-2025:22620 issued
- 2025-12-02: patched: Fix released in Red Hat OpenShift Dev Spaces 3.22.1

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/errata/RHSA-2025:22620](https://access.redhat.com/errata/RHSA-2025:22620)

## Related threats

- [Eclipse Che che-machine-exec command injection vulnerability](https://junglewise.ai/threats/cve-2026-114278-the-che-machine-exec-service-constructs-a-shell-command-by)
- [Eclipse Che SSRF in SCM and factory resolver endpoints](https://junglewise.ai/threats/cve-2026-86671-in-eclipse-che-versions-7-29-0-and-later-the-get-api-scm-resolve)
- [Eclipse Che dashboard SSRF in data resolver endpoint](https://junglewise.ai/threats/cve-2026-86590-eclipse-che-dashboard-ssrf-in-data-resolver-endpoint)