[Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when…
- Exploited
- No known exploitation
- Fix
- Fixed in 1.3.2
- Who is exposed
- Default setups
Do first: Check every install: default setups are affected.
- Last modified
- FIRST's estimate of the chance attackers exploit it in the next 30 days, updated daily.What do these mean? →
- 0.30% · 23rd percentile
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 42/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Eclipse CSI otterdog webapp lets a remote attacker without logging in run arbitrary Python code on the host by sending a crafted GitHub webhook request. This works when the webhook secret is unset or empty, because the signature check is then skipped and the request body reaches an `eval()` call.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure22/25Default setups, reachable over the network without a login
- Reach10/20Affects PyPI packages
- Severity9.5/10CVSS 9.5
- No patch0/5No signal
What would change the score
- Would score about 82 if added to CISA KEV
- Would score about 77 if CISA's SSVC rates exploitation active
Impact
- Widely used
otterdog has 76 weekly downloads.Source: pypistats.org
What to do
Check every install: default setups are affected.
Upgrade to a fixed version: 1.3.2.
Timeline
- CVE published
- First seen by cve.now
- Posted on X by cve.now
Affected versions
- otterdogPyPI
From 0.9.0 · fixed in 1.3.2
Fixed in 1.3.2 (released May 7, 2026, 186 days before disclosure).
The latest release, 1.7.1, is not affected.
Evidence 3
- Advisory
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123870
Is CVE-2026-123870 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The otterdog webapp passes a webhook request body into eval() after format-string injection, so a remote party without a login can run arbitrary code as the webapp process, including arbitrary Python on the webapp host.Source: github.com
Which versions are affected by CVE-2026-123870?
otterdog (PyPI): from 0.9.0 before 1.3.2.Source: cve.now feed data
Am I affected, and how do I check?
The condition text covers all versions of the otterdog webapp deployed from a source checkout or the ghcr.io/eclipse-csi/otterdog container, up to and including current main. The product range lists 0.9.0 through a fix at 1.3.2, so the two sources do not line up. To check a deployment, look at whether it runs from a source checkout or that container image and which otterdog version or commit it was built from.Source: github.com
How do I fix CVE-2026-123870?
The facts do not name a confirmed fixed release, so no upgrade target can be stated from them. The listed range ends at 1.3.2, but the condition text extends to current main, so confirm the fixed version in the Eclipse advisory before upgrading.Source: github.com