It can expose a host when the GitHub webhook secret is unset or empty.In that configuration, an unauthenticated network client can reach unsafe dynamic evaluation with attacker-controlled webhook data. Eclipse assigns a CVSS 4.0 score of 9.5 Critical.
What it allows
How Does CVE-2026-123870 Affect Eclipse Otterdog?
The web application builds a filter expression from incoming webhook data and evaluates it dynamically. Attacker-controlled content can therefore cross the intended data boundary and become executable Python.
A second control failure makes the path remotely reachable. When the webhook secret is missing, signature verification is skipped rather than failing closed.
An unauthenticated attacker who can reach the web application may execute code with the application's privileges. The condition requires a deployment with no non-empty webhook secret.
Who is affected
The GitHub advisory metadata marks Otterdog versions from 0.9.0 up to, but not including, 1.3.2 as affected. It says the PyPI package is not affected because the web application is excluded from that distribution.
The advisory is inconsistent about remediation. Its metadata lists 1.3.3 as patched, while its description says no patch is yet available. Administrators should verify the advisory before relying on a version-only fix.
What to do
-
Set a non-empty GitHub webhook secret
Configure a strong, non-empty secret and confirm signature verification is active. The advisory says the injection path is unreachable when the secret is correctly configured.
-
Restrict network access to the web application
Brandefense recommends limiting the Otterdog web application to trusted GitHub delivery paths and authorized administration networks until remediation is verified.
-
Inventory affected Otterdog deployments
Identify source and container deployments running the web application from version 0.9.0. Treat instances without a configured webhook secret as the highest priority.
-
Verify the vendor's current remediation guidance
Check the Eclipse advisory before upgrading because its patched-version metadata and description conflict. Validate the installed version and secret configuration after maintenance.
-
Review application and host telemetry
Brandefense recommends reviewing webhook, application, and process telemetry for unexpected activity. Investigate anomalies that occurred while an affected deployment lacked signature verification.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-123870?
It is a critical remote code execution vulnerability in the Eclipse Otterdog web application. It combines unsafe dynamic evaluation with skipped webhook signature verification.
When is CVE-2026-123870 remotely exploitable?
The exposed condition exists when the web application has no non-empty GitHub webhook secret. An unauthenticated network client must also be able to reach it.
Which Eclipse Otterdog versions are affected?
The advisory metadata lists versions from 0.9.0 up to, but not including, 1.3.2. The separately distributed PyPI package excludes the web application and is not affected.
Is a fixed version available for CVE-2026-123870?
The advisory is inconsistent. Its metadata lists 1.3.3 as patched, but its description says no patch is available. Verify the latest vendor guidance before upgrading.
