Github.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333

9 CVSS

Vulnerability Description

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12548

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Red Hat would like to thank Richard Leach (LME) for reporting this issue.

References

More from Red Hat

View All →

CVE-2025-9909

Aap-gateway: improper path validation in gateway allows credential exfiltration

Medium 6.7

CVE-2025-9908

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Medium 6.7

CVE-2025-9907

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Medium 6.7

CVE-2025-9901

Libsoup: improper handling of http vary header in libsoup caching

Medium 5.9

CVE-2025-9820

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Medium 4

Affected Vendor

Red Hat

View all reports →

Affected Software

Red Hat OpenShift Dev Spaces (RHOSDS) 3.22, Red Hat OpenShift Dev Spaces (RHOSDS) 3.23, Red Hat OpenShift Dev Spaces (RHOSDS) 3.24

Vulnerable Versions:

sha256:3de7dd8077a9201eb7ff56c340629184773d6c06de9d6e083e13c5b51a82009c, sha256:a6fe7e233fa23e1fff9c74c5d4cbe800534561131b5be59533e88ede24452e3a, sha256:ced0e45c01cb5f473deb4fb137249b743b907d27172fbabd223024c4000ba56f