CVE-2026-123870

— UNSCOREDpublic exploit available

Published 2026-11-09 · Updated 2026-11-09

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.

Weaknesses

CWE-95

Public exploit & PoC references

https://github.com/eclipse-csi/otterdog/commit/bbc9e3ced3665f09fc4632f11b5867524eda7f72
https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-32xf-7j44-xq72

All references

https://github.com/eclipse-csi/otterdog/commit/bbc9e3ced3665f09fc4632f11b5867524eda7f72
https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-32xf-7j44-xq72
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/554

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2024-42002PoC
CRITICALCVE-2025-53837PoC
CRITICALCVE-2026-100741
HIGHCVE-2026-100840PoC
HIGHCVE-2026-100842PoC
MEDIUMCVE-2026-101861PoC
MEDIUMCVE-2026-105315PoC
CRITICALCVE-2026-108263PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.