CVE-2026-123870

{
  "etk_id": "ETK-2026-3939",
  "cve_id": "CVE-2026-123870",
  "display_id": "CVE-2026-123870",
  "ghsa_id": "GHSA-32xf-7j44-xq72",
  "euvd_id": "EUVD-2026-119883",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated code injection in otterdog web application",
  "summary": "Otterdog webapp deployments are affected when processing GitHub webhook requests. An unauthenticated remote party may run Python code on the application host if the webhook secret is unset or empty.",
  "mitigation": "Upgrade the PyPI otterdog package to version 1.3.2 or later. Set GITHUB_WEBHOOK_SECRET to a non-empty secret and restrict webhook access until the update is complete.",
  "vendor": "Eclipse Foundation",
  "product": "otterdog",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0.9.0, < 1.3.2"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.3.3"
      ],
      "package_name": "otterdog",
      "purl": null
    }
  ],
  "cwes": [
    95
  ],
  "cvss_score": 9.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": 0.003,
  "epss_percentile": 0.2314,
  "epss_asof": "2026-11-09",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.102055566666667,
  "t0_at": "2026-11-09T09:00:13.022000+00:00",
  "signals": {
    "public_poc": {
      "at": "2026-11-09T09:00:41+00:00",
      "days": 0.00032381944444444445,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T09:00:13.022000+00:00",
      "url": "https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-32xf-7j44-xq72"
    },
    "trigger_signal": {
      "at": "2026-11-09T09:00:13.022000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-09T09:00:13.022000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-123870"
    }
  }
}