CVE-2026-123717

— UNSCOREDpublic exploit available

Published 2026-11-10 · Updated 2026-11-10

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.

Weaknesses

CWE-78

Public exploit & PoC references

https://github.com/eclipse-csi/otterdog/releases/tag/v1.8.0
https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmp

All references

https://github.com/eclipse-csi/otterdog/releases/tag/v1.8.0
https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmp
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/552

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2013-20007PoC
HIGHCVE-2020-37279PoC
CRITICALCVE-2020-37282PoC
HIGHCVE-2022-51019PoC
CRITICALCVE-2024-4457PoC
HIGHCVE-2025-14754
CRITICALCVE-2025-31704
CRITICALCVE-2025-71429PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.