CVE-2026-86671

Description

A flaw was found in Eclipse Che. Specific API endpoints fail to validate user-supplied web addresses, leading to a Server-Side Request Forgery (SSRF) vulnerability where the server fetches arbitrary locations without restriction. An authenticated attacker can exploit this issue to read sensitive local files, such as Kubernetes service account tokens, or query restricted internal network services and cloud metadata. Additionally, an attacker can entice a user to open a malicious workspace configuration to exfiltrate the victim's source code management access tokens.

Statement

This vulnerability is rated as Moderate impact for Red Hat OpenShift Dev Spaces because successful exploitation requires either authenticated access or social engineering to entice a victim into loading an untrusted workspace definition. While an attacker can leverage server-side requests to read container-local secrets or probe internal network endpoints, the flaw does not directly permit arbitrary code execution or compromise host integrity and availability. The overall impact is further bounded by the network visibility and service account permissions assigned to the server deployment.

Understanding the Weakness (CWE)

CWE-918

Confidentiality

Technical Impact: Read Application Data

Integrity

Technical Impact: Execute Unauthorized Code or Commands

Access Control

Technical Impact: Bypass Protection Mechanism

By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.