CVE-2026-86590

Eclipse Che versions 7.79.0 through 7.121.0 contain a server-side request forgery (SSRF) in the dashboard backend's POST /dashboard/api/data/resolver endpoint. The endpoint passes a caller-supplied URL directly to an outbound HTTP GET request with no host filtering, and the operator-configured al...