CVE-2026-86590: Eclipse Che SSRF Vulnerability

CVE-2026-86590 Overview

CVE-2026-86590 is a Server-Side Request Forgery (SSRF) vulnerability in the Eclipse Che dashboard backend. The flaw affects Eclipse Che versions 7.79.0 through 7.121.0. The POST /dashboard/api/data/resolver endpoint forwards a caller-supplied URL to an outbound HTTP GET request without host filtering. An authenticated user can abuse this behavior to reach internal network resources. The operator-configured allowlist at spec.devEnvironments.allowedSources.urls is not consulted before the request is issued. Eclipse released a fix in version 7.122.0. The vulnerability is classified under [CWE-918].

Critical Impact
Authenticated users can pivot from the dashboard backend to internal services, including cloud instance metadata at 169.254.169.254, loopback interfaces, RFC-1918 ranges, and in-cluster Kubernetes services.

Affected Products

Eclipse Che 7.79.0 through 7.121.0 (che-dashboard component)
Deployments exposing the dashboard backend to authenticated tenants
Cloud-hosted Che instances with reachable metadata services or Kubernetes API endpoints

Discovery Timeline

2026-09-08 - CVE-2026-86590 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86590

Vulnerability Analysis

The Eclipse Che dashboard exposes a resolver endpoint that fetches remote resources on behalf of authenticated users. The backend accepts a URL parameter and issues an outbound HTTP GET request. The implementation performs no host validation, no allowlist enforcement, and no protection against redirect-based bypass. An authenticated user submits a crafted URL targeting an internal address, and the backend returns the response body to the caller.

The reachable targets include cloud instance metadata services, loopback services bound to 127.0.0.1, private network ranges defined in RFC-1918, and Kubernetes services accessible from the pod's network namespace. On managed cloud platforms, metadata responses can include temporary IAM credentials tied to the dashboard's service identity.

Root Cause

The root cause is missing input validation before initiating an outbound HTTP request. The resolver handler in che-dashboard passes user-controlled URLs directly to the HTTP client. Three defensive controls are absent: private-address blocking, IPv4-mapped IPv6 bypass prevention, and enforcement of spec.devEnvironments.allowedSources.urls. HTTP redirects are also followed by default, which permits redirect-based allowlist evasion when protections are added downstream.

Attack Vector

An attacker requires authenticated access to the Che dashboard. The attacker sends a POST request to /dashboard/api/data/resolver containing a URL that references an internal target. The backend fetches the target and returns the response body. Attackers commonly target the cloud metadata endpoint at http://169.254.169.254/latest/meta-data/iam/security-credentials/ to harvest credentials, or in-cluster service DNS names to probe Kubernetes workloads. See the Eclipse GitLab Vulnerability Report and the GitHub Pull Request for technical details.

Detection Methods for CVE-2026-86590

Indicators of Compromise

Requests to /dashboard/api/data/resolver with URL parameters targeting 169.254.169.254, 127.0.0.1, localhost, or IPv4-mapped IPv6 forms such as ::ffff:127.0.0.1.
Outbound HTTP GET requests from the dashboard pod to RFC-1918 addresses or in-cluster service DNS names not associated with normal operation.
Unexpected access to cloud metadata service credential paths originating from the Che dashboard workload.

Detection Strategies

Parse dashboard access logs for POST requests to the resolver endpoint and extract the target URL for allowlist comparison.
Correlate outbound network flows from the dashboard pod against a baseline of expected external hosts.
Alert on any dashboard-originated traffic to link-local, loopback, or private address ranges.

Monitoring Recommendations

Enable egress logging at the pod or namespace level and forward events to a centralized analytics platform.
Monitor cloud provider audit logs for API calls made with the dashboard service account, especially token issuance events.
Track version metadata across Che deployments to identify unpatched instances running 7.79.0 through 7.121.0.

How to Mitigate CVE-2026-86590

Immediate Actions Required

Upgrade Eclipse Che to version 7.122.0 or later, which enforces private-address blocking, IPv4-mapped IPv6 bypass prevention, operator allowlist enforcement, and disables HTTP redirects on the outbound request.
Restrict dashboard access to trusted users and review authentication provider configuration to reduce the pool of authenticated actors.
Rotate any cloud credentials associated with the dashboard workload if exploitation is suspected.

Patch Information

The fix is available in Eclipse Che 7.122.0. The upstream patch is documented in the GitHub Pull Request, which adds host filtering, blocks IPv4-mapped IPv6 addresses, enforces the operator allowlist, and disables HTTP redirects on the resolver's outbound requests.

Workarounds

Apply network policies that deny egress from the dashboard pod to 169.254.169.254, loopback, and RFC-1918 destinations except where required.
Use IMDSv2 with hop-limit set to 1 on AWS to prevent metadata access from container workloads.
Place a filtering egress proxy in front of the dashboard workload and restrict permitted destinations to the operator-defined allowlist.

bash

# Example Kubernetes NetworkPolicy restricting egress from the Che dashboard pod
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: che-dashboard-egress-restrict
  namespace: eclipse-che
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/component: che-dashboard
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 169.254.0.0/16
              - 127.0.0.0/8
              - 10.0.0.0/8
              - 172.16.0.0/12
              - 192.168.0.0/16