Is CVE-2026-86590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86590 being exploited in the wild.

How severe is CVE-2026-86590?

Informational severity, with a CVSS score of 0, published 8 September 2026.

Which products and versions are affected?

Eclipse Che 7.79.0 through 7.121.0.

Is there a fix for CVE-2026-86590?

A patch was published on 2026-08-31: Fix merged in version 7.122.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86590 attacked?

It is attacked over the network.

Am I affected by CVE-2026-86590?

Check whether you run Eclipse Che at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86590: Eclipse Che dashboard SSRF in data resolver endpoint

CVE-2026-86590 · Severity: info · CVSS 0 · Published 2026-09-08

Eclipse Che's dashboard backend includes a data resolver API endpoint used to fetch remote configuration files. An authenticated user can exploit a server-side request forgery (SSRF) vulnerability in this endpoint to access internal network services—such as cloud provider credential endpoints, Kubernetes services, and loopback addresses—that should not be directly reachable, potentially exposing sensitive credentials and enabling lateral movement within the infrastructure.

Technologies: Eclipse Che. Vendors: Eclipse.

Quick answers

Is CVE-2026-86590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86590 being exploited in the wild.
How severe is CVE-2026-86590?: Informational severity, with a CVSS score of 0, published 8 September 2026.
Which products and versions are affected?: Eclipse Che 7.79.0 through 7.121.0.
Is there a fix for CVE-2026-86590?: A patch was published on 2026-08-31: Fix merged in version 7.122.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86590 attacked?: It is attacked over the network.
Am I affected by CVE-2026-86590?: Check whether you run Eclipse Che at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the POST /dashboard/api/data/resolver endpoint, which accepts a caller-supplied URL and passes it directly to an axios HTTP GET request without filtering the destination address. The only input validation is a JSON schema pattern requiring URLs to start with "http", which permits loopback (127.x, ::1), link-local (169.254.x for cloud IMDS), RFC-1918 private ranges (10.x, 172.16–31.x, 192.168.x), and in-cluster Kubernetes service addresses. The endpoint is protected by upstream OAuth authentication, so only authenticated dashboard users can exploit it, but in a multi-tenant deployment this is a low-privilege baseline attacker. The operator-configured allowlist (spec.devEnvironments.allowedSources.urls) exists in the configuration but is not enforced by this route. The fix in version 7.122.0 adds destination IP filtering, operator allowlist enforcement, and disables HTTP redirects.

Affected products

Eclipse Che 7.79.0 through 7.121.0

Timeline

2026-09-08: disclosed
2026-08-31: patched: Fix merged in version 7.122.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.