Critical · published January 13, 2026
🚨 A simple connection to TCP port 3333 is all it takes for an attacker to seize control! This flaw in Eclipse Che allows unauthenticated remote command execution, making it a potential nightmare for your Developer Workspaces! 🔥 Think of it like a restaurant with an open kitchen where anyone can walk in and order anything without a reservation. The unregulated JSON-RPC/websocket API acts like a server who's never asked to see ID — letting strangers shout orders they shouldn't be able to! An attacker can execute arbitrary commands in other users' Developer Workspace containers, stealing sensitive information like SSH keys and tokens. This means they could potentially gain access to entire systems or sensitive data, leading to catastrophic breaches and loss of trust.
Think of it like a restaurant with an open kitchen where anyone can walk in and order anything without a reservation. The unregulated JSON-RPC/websocket API acts like a server who's never asked to see ID — letting strangers shout orders they shouldn't be able to! This vulnerability in Eclipse Che's che-machine-exec allows unauthenticated access through an exposed JSON-RPC/websocket API on TCP port 3333, enabling arbitrary command execution and secret exfiltration from other users' containers.
An attacker can execute arbitrary commands in other users' Developer Workspace containers, stealing sensitive information like SSH keys and tokens. This means they could potentially gain access to entire systems or sensitive data, leading to catastrophic breaches and loss of trust. Immediately restrict access to port 3333 and implement authentication for the JSON-RPC/websocket API. Review and apply updates from Eclipse Che to patch this vulnerability, and conduct an audit of your Developer Workspaces for any suspicious activities. You're already on the path to fixing this! Follow these steps and bolster your security like a pro! 🛡️