THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2025-12548 (CRITICAL 9.0) — A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API expose

[NVD] CVE-2025-12548 (CRITICAL 9.0) — A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API expose

lownvdPublished 2026-01-13

CVE-2025-12548 CVSS: 9.0 CRITICAL Published: 2026-01-13T16:15:55.527

A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH keys, tokens, etc.) from other users' Developer Workspace containers, via an unauthenticated JSON-RPC / websocket API exposed on TCP port 3333.

Indicators of compromise

CVE-2025-12548cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2025-12548