CVE-2026-123870
CRITICAL
INFO
Priority: 0.03
BB Relevance:
79/100
Published: 2026-11-09
Modified: 2026-11-12
First seen: 2026-11-09
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
Present
VC:
High
VI:
High
VA:
High
Description
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Eclipse Foundation | otterdog | 0.9.0 < 1.3.2 |
| Eclipse Foundation | otterdog | 0.9.0 < 1.3.2 |