Unauthenticated Command Injection via kubeconfig Username in che-machine-exec

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

The che-machine-exec service constructs a shell command by concatenating user-controlled input (the username and namespace fields from the /exec/init and /exec/config JSON endpoints) into a double-quoted sh -c "echo "..." > ..." invocation without any escaping. When che-machine-exec is run with authentication disabled (its default), any network-reachable attacker can achieve remote code execution in containers che-machine-exec is configured to access, via shell command substitution ($(...) or backticks).

Etkilenen sürümler1 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• gitlab.eclipse.org/security/vulnerability-reports/-/work_items/359 Diğer
• github.com/…ommit/a78541c29e5f48fd59a49cf206bc0e507628bd23 Diğer
• gitlab.eclipse.org/security/cve-assignment/-/work_items/476 Diğer

Kayıt geçmişi

1. 28 Eki 2026 14:55Yayımlandı

İlgili açıklar

• 7,8 CVE-2026-118615Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability
• 6,8 CVE-2026-118607Alpine iLX-F511 diagapp Command Injection Vulnerability
• 8,8 CVE-2026-106079Session Smart Router and Session Smart Conductor: Improper validation of a field causes privilege escalation when updating the YANG configuration
• 9,8 CVE-2026-103406Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.
• 8,8 CVE-2026-103403Session Smart Router and Session Smart Conductor: Unvalidated input causes arbitrary file deletion and command execution when deleting audit rules
• 8,8 CVE-2026-116778FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution