CVE-2026-86671

Published 5 October 2026 · tracked since 6 October 2026

Description

In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which calls `new URL(url).openConnection()` with no scheme or host allow-list and returns the response body to the caller. Any auth

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-105644 MEDIUM 6.8
• CVE-2026-105645 MEDIUM 4.9
• CVE-2026-105646 MEDIUM 4.9
• CVE-2026-105712 LOW 3.6
• CVE-2026-105638 CRITICAL 9.1
• CVE-2026-105640 CRITICAL 9.1
• CVE-2026-105641 CRITICAL 9.8
• CVE-2026-105642 HIGH 8.8
• CVE-2026-105643 HIGH 7.3
• CVE-2026-105386 HIGH 7.3

→ Open the live CVE board · all tools