{"id":"CVE-2026-123717","aliases":["EUVD-2026-120878","GHSA-886p-g538-rcmp"],"status":"published","title":"[Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution","description":"OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:\u003cpath\u003e or bitwarden:\u003citem\u003e@\u003cfield\u003e) or credential identifier that is resolved when otterdog apply is run.","severity":{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-14","score":0.0108,"percentile":0.65621,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2026-11-10T11:17:20Z","modified":"2026-11-12T02:48:30Z","products":[{"vendor":"eclipse csi","product":"otterdog"},{"vendor":"eclipse foundation","product":"otterdog"}],"references":[{"url":"https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmp","tags":["advisory"]},{"url":"https://github.com/eclipse-csi/otterdog/releases/tag/v1.8.0","tags":["web"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/552","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123717.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123717","tags":["advisory"]},{"url":"https://github.com/eclipse-csi/otterdog","tags":["package"]},{"url":"https://pypi.org/project/otterdog/","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-123717","title":"[Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution","description":"OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:\u003cpath\u003e or bitwarden:\u003citem\u003e@\u003cfield\u003e) or credential identifier that is resolved when otterdog apply is run.","status":"published","published":"2026-11-10T11:17:20.075Z","modified":"2026-11-10T11:17:20.075Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-10T12:38:31.627777Z"}],"euvd":[{"id":"EUVD-2026-120878","description":"OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:\u003cpath\u003e or bitwarden:\u003citem\u003e@\u003cfield\u003e) or credential identifier that is resolved when otterdog apply is run.","status":"published","published":"2026-11-10T11:17:20Z","modified":"2026-11-10T11:17:20Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"updated_at":"2026-11-10T12:20:52.279403Z"}],"nvd":[{"id":"CVE-2026-123717","description":"OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:\u003cpath\u003e or bitwarden:\u003citem\u003e@\u003cfield\u003e) or credential identifier that is resolved when otterdog apply is run.","status":"published","published":"2026-11-10T12:17:17.38Z","modified":"2026-11-12T18:44:06.563Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-10T14:19:29.397466Z"}],"osv":[{"id":"CVE-2026-123717","title":"[Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution","description":"OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:\u003cpath\u003e or bitwarden:\u003citem\u003e@\u003cfield\u003e) or credential identifier that is resolved when otterdog apply is run.","status":"published","published":"2026-11-10T11:17:20.075Z","modified":"2026-11-14T02:30:54.515883074Z","cvss":[{"version":"4.0","score":8.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-12T03:30:55.144331Z"}]}}