CVE-2026-123717
[Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution
CVE-2026-123717 is a high vulnerability (CVSS 8.8) in Eclipse Csi Otterdog, published November 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. No source names a fixed version.
- Severity
- 8.8 HighCVSS 4.0, CVE List
- Exploit chance
- 1.08%EPSS, 65th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
What each source reports
CVE List Score used
[Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution
OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.
- Record
CVE-2026-123717- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-78
- Updated
- 2026-11-10
EUVDEUVD-2026-120878
OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.
- Record
EUVD-2026-120878- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-10
NVD
OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.
- Record
CVE-2026-123717- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-78
- Updated
- 2026-11-10
OSV
[Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution
OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.
- Record
CVE-2026-123717- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-78
- Updated
- 2026-11-12
History
| Recorded | Changed | Sources |
|---|---|---|
| references | OSV | |
| aliases, references | NVD, OSV | |
| cwes, products, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmp
gitlab.eclipse.org/security/cve-assignment/-/work_items/552
nvd.nist.gov/vuln/detail/CVE-2026-123717
pypi.org/project/otterdog