The vulnerability CVE-2025-12548 affects Eclipse Che's che-machine-exec component integrated in Red Hat OpenShift Dev Spaces. It permits unauthenticated remote code execution and secret exfiltration by exploiting an unauthenticated JSON-RPC/websocket API on TCP port 3333. This flaw allows attackers to run arbitrary commands and access sensitive data from other users' Developer Workspace containers. Red Hat has released OpenShift Dev Spaces 3.23.1 to remediate this issue. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function).

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary commands remotely and exfiltrate sensitive secrets such as SSH keys and tokens from other users' containers. This compromises confidentiality, integrity, and availability of the affected system components. The severity is rated high by Red Hat.

Red Hat has released OpenShift Dev Spaces version 3.23.1 which addresses CVE-2025-12548. Users should upgrade to this fixed version to remediate the vulnerability. Before applying this update, ensure all previously released errata relevant to your system have been applied. Additionally, apply the security best practices outlined in the Red Hat OpenShift Dev Spaces Administration Guide. No other mitigations or temporary fixes are documented by Red Hat.