CVE-2025-12548: Eclipse Che RCE Vulnerability

CVE-2025-12548 Overview

A critical vulnerability has been identified in Eclipse Che che-machine-exec that allows unauthenticated remote arbitrary command execution and secret exfiltration from other users' Developer Workspace containers. The flaw exists in an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333, enabling attackers to execute commands and steal sensitive data including SSH keys and tokens without authentication.

Critical Impact
This vulnerability enables unauthenticated attackers to execute arbitrary commands remotely and exfiltrate sensitive secrets (SSH keys, tokens, credentials) from other users' Developer Workspace containers, potentially compromising entire development environments and supply chains.

Affected Products

Eclipse Che che-machine-exec component
Red Hat OpenShift Dev Spaces (affected versions addressed in RHSA-2025:22620)
Red Hat OpenShift Dev Spaces (affected versions addressed in RHSA-2025:22623)

Discovery Timeline

January 13, 2026 - CVE-2025-12548 published to NVD
January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-12548

Vulnerability Analysis

This vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The che-machine-exec component in Eclipse Che exposes a JSON-RPC API over WebSocket connections on TCP port 3333. This API is designed to provide terminal/command execution capabilities within Developer Workspace containers. However, the critical flaw is that this API endpoint lacks proper authentication mechanisms, allowing any network-accessible attacker to connect and execute arbitrary commands.

The attack surface is particularly dangerous in multi-tenant development environments where multiple users share the same infrastructure. An attacker exploiting this vulnerability can pivot between workspace containers, accessing sensitive developer credentials, SSH private keys, API tokens, and other secrets stored in the development environment.

Root Cause

The root cause stems from missing authentication controls on the JSON-RPC/WebSocket API endpoint exposed by che-machine-exec on TCP port 3333. The service was implemented without requiring authentication before processing command execution requests, violating the principle of secure-by-default design. This allows any client that can establish a network connection to the exposed port to interact with the API and execute commands within workspace containers.

Attack Vector

The vulnerability is exploitable over the network by any unauthenticated attacker who can reach TCP port 3333 on the che-machine-exec service. The attack flow involves:

An attacker identifies an exposed Eclipse Che instance with the vulnerable che-machine-exec component
The attacker establishes a WebSocket connection to port 3333
Without any authentication challenge, the attacker sends JSON-RPC requests to execute arbitrary commands
Commands execute within Developer Workspace containers, enabling file access, secret exfiltration, and further lateral movement

The attack can be executed remotely without user interaction, though the attacker requires low-level privileges to initiate the network connection. Successful exploitation impacts confidentiality and integrity across security boundaries (changed scope), as attackers can access other users' workspaces.

Detection Methods for CVE-2025-12548

Indicators of Compromise

Unexpected WebSocket connections to TCP port 3333 on che-machine-exec services
Unusual JSON-RPC requests or command execution patterns in workspace containers
Unauthorized access to files containing SSH keys, tokens, or credentials within developer workspaces
Anomalous outbound data transfers from workspace containers that may indicate secret exfiltration

Detection Strategies

Monitor network traffic for unexpected connections to TCP port 3333 from external or unauthorized sources
Implement logging and alerting on JSON-RPC/WebSocket API calls to che-machine-exec services
Review container logs for unusual command execution patterns or access to sensitive files
Deploy network segmentation monitoring to detect lateral movement between workspace containers

Monitoring Recommendations

Enable comprehensive audit logging for all Eclipse Che and che-machine-exec components
Configure alerts for authentication failures or unauthorized API access attempts
Implement file integrity monitoring for SSH key directories and token storage locations in developer workspaces
Monitor for unusual process spawning within workspace containers that may indicate command injection

How to Mitigate CVE-2025-12548

Immediate Actions Required

Apply the latest security patches from Red Hat immediately (see RHSA-2025:22620, RHSA-2025:22623, RHSA-2025:22652)
Restrict network access to TCP port 3333 using firewall rules or network policies
Audit existing developer workspaces for signs of compromise or unauthorized access
Rotate any SSH keys, tokens, or credentials that may have been exposed in affected environments

Patch Information

Red Hat has released multiple security advisories addressing this vulnerability:

For detailed CVE analysis and tracking information, refer to the Red Hat CVE Analysis for CVE-2025-12548 and Red Hat Bug Report #2408850.

Workarounds

Implement network policies to block external access to TCP port 3333 on che-machine-exec services
Deploy reverse proxy or API gateway with authentication in front of the vulnerable endpoint
Isolate Eclipse Che deployments in network segments with strict ingress/egress controls
Consider temporarily disabling the che-machine-exec component if terminal functionality is not critical

bash

# Example: Block external access to port 3333 using iptables
iptables -A INPUT -p tcp --dport 3333 -s 127.0.0.1 -j ACCEPT
iptables -A INPUT -p tcp --dport 3333 -j DROP

# Example: Kubernetes NetworkPolicy to restrict che-machine-exec access
# Apply this to limit traffic to the vulnerable service
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-che-machine-exec
spec:
  podSelector:
    matchLabels:
      app: che-machine-exec
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: che-server
    ports:
    - protocol: TCP
      port: 3333
EOF