Eclipse Che dashboard backend (POST /dashboard/api/data/resolver): The dashboard backend passes a user-supplied URL

Impact

The dashboard backend passes a user-supplied URL straight into an outbound HTTP GET with no host filtering, so any authenticated Che user can read responses from the cloud instance metadata service at 169.254.169.254, loopback, RFC-1918 ranges and in-cluster Kubernetes services. On a cluster where the Che pod runs with an instance profile or workload identity, that is a direct path to cloud credentials for the whole node pool, and to unauthenticated internal APIs a developer workspace was never meant to reach. The operator-configured allowlist (spec.devEnvironments.allowedSources.urls) is not consulted, so a deployment that looks locked down is not. Che sits on the same clusters that host GPU workspaces, where the reachable internal surface includes the scheduler and registry.

Who can reach it

Any user who can authenticate to the Che dashboard - typically every developer with a workspace - reaching it over the normal HTTPS route. No cluster credentials or pod access required.

What to do

Upgrade to Eclipse Che 7.122.0, which blocks private addresses, prevents the IPv4-mapped IPv6 bypass, enforces the operator allowlist and disables redirects on the outbound request. This is a controller-driven rolling restart of the dashboard deployment - no node drain. Until then, restrict egress from the dashboard pod with a NetworkPolicy and require IMDSv2 or equivalent hop-limited metadata access on the nodes.

References

Related entries

• vLLM: allowed_token_ids validated against tokenizer length, corrupting shared GPU logit-bias stateCVE-2026-93840 · vLLM (SamplingParams allowed_token_ids validation / LogitBiasState)Medium
• vLLM: unbounded prompt token ids write out of bounds in the penalty bincount Triton kernelCVE-2026-93841 · vLLM (Triton _bincount_kernel, penalty prompt-presence bitset)Medium
• OpenLLM: Local file inclusion via the web applicationCVE-2024-8982 · OpenLLMMedium
• ONNX: untrusted model crashes shape inference via missing or negative num_scan_inputsCVE-2026-115921 · ONNX shape inference (ScanInferenceFunction num_scan_inputs attribute validation)Medium
• ONNX: packed low-bit tensor expands to an unbounded allocation and exhausts host memoryCVE-2026-115922 · ONNX numpy_helper / ReferenceEvaluator (_unpack_2bit and _unpack_4bit sizing from TensorProto.dims)Medium
• Weights & Biases OpenUI: Unauthenticated endpoints allow file upload and downloadCVE-2024-10649 · Weights & Biases OpenUIMedium