CVE-2026-123717

UNKNOWN 0.0

[Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.

CWE	CWE-78
Vendor	eclipse csi
Product	otterdog
Published	Nov 10, 2026

Stay Ahead of the Next One

Get instant alerts for eclipse csi otterdog

Be the first to know when new unknown vulnerabilities affecting eclipse csi otterdog are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Eclipse CSI / otterdog

0.1.0 ≤ 1.7.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmp github.com: https://github.com/eclipse-csi/otterdog/releases/tag/v1.8.0 gitlab.eclipse.org: https://gitlab.eclipse.org/security/cve-assignment/-/work_items/552

Credits

Kiki Lee, from PwC HK DarkLab