CVE-2026-86590: SSRF
In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery (SSRF) to read responses from internal network addresses, including the cloud instance metadata service (169.254.169.254), loopback interfaces, RFC-1918 private ranges, and in-cluster Kubernetes services. The operator-configured allowlist (spec.devEnvironments.allowedSources.urls) is not consulted. The vulnerability is fixed in version 7.122.0, which adds private-address blocking, IPv4-mapped IPv6 bypass prevention, operator allowlist enforcement, and disables HTTP redirects on the outbound request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Eclipse Cheto a version that resolves this vulnerability.Fixed in 7.122.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Eclipse Che user can exploit the vulnerable dashboard endpoint. The request is made by the dashboard backend, allowing the user to reach network locations accessible from that server.
Are default network protections or configured source allowlists effective against this issue?
No. In affected versions, the endpoint does not consult spec.devEnvironments.allowedSources.urls, so the operator-configured allowlist does not restrict caller-supplied URLs.
What internal resources could be exposed?
The backend can be induced to read responses from loopback addresses, RFC-1918 private ranges, in-cluster Kubernetes services, and the cloud instance metadata address at 169.254.169.254.
What version resolves the issue?
Upgrade to Eclipse Che 7.122.0. This release blocks private addresses, prevents IPv4-mapped IPv6 bypasses, enforces the operator allowlist, and disables redirects for the outbound request.