CVE-2026-86671

{
  "etk_id": "ETK-2026-668",
  "cve_id": "CVE-2026-86671",
  "display_id": "CVE-2026-86671",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-92474",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Server-side request forgery in Eclipse Che",
  "summary": "Eclipse Che versions 7.29.0 through versions before 7.123.0 allow authenticated users to supply URLs that the server fetches without sufficient scheme or host restrictions. An attacker can use this to access local files or internal network services and may cause SCM credentials to be sent to an attacker-controlled host; credential exposure can also occur if a victim opens a workspace using a malicious devfile.",
  "mitigation": "Upgrade Eclipse Che to version 7.123.0 or later. Until upgrades are complete, restrict access to affected resolver endpoints and prevent untrusted devfiles from being opened.",
  "vendor": "Eclipse Foundation",
  "product": "Eclipse Che",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 7.29.0, < 7.123.0"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7.123.0"
      ],
      "package_name": "Eclipse Che",
      "purl": null
    }
  ],
  "cwes": [
    918
  ],
  "cvss_score": 8.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N",
  "epss_score": 0.0025,
  "epss_percentile": 0.1561,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 35.591750983333334,
  "t0_at": "2026-10-05T16:21:57.738000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-05T16:21:57.738000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-05T16:21:57.738000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-86671"
    }
  }
}