CVE-2026-86590

    Dashboard / Vulnerabilities / CVE-2026-86590

    CVE-2026-86590

    Published: 8 Sept 2026Last Modified: 10 Sept 2026

    Summary:

    Details: In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering. An authenticated user can exploit this server-side request forgery (SSRF) to read responses from internal network addresses, including the cloud instance metadata service (169.254.169.254), loopback interfaces, RFC-1918 private ranges, and in-cluster Kubernetes services. The operator-configured allowlist (spec.devEnvironments.allowedSources.urls) is not consulted. The vulnerability is fixed in version 7.122.0, which adds private-address blocking, IPv4-mapped IPv6 bypass prevention, operator allowlist enforcement, and disables HTTP redirects on the outbound request.

    References: https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/617, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86590.json, https://nvd.nist.gov/vuln/detail/CVE-2026-86590, https://github.com/eclipse-che/che-dashboard/pull/1655

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- db0b0859b3481fb34e178f4d789a7f11b07f19b9
    Fixed -ab1beea71f8d1eb3b7b52b02d245624a2f53022b

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-86590 | CVE-DB