Quick answers
- Is CVE-2026-123870 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-123870 being exploited in the wild.
- How severe is CVE-2026-123870?
- Informational severity, published 9 November 2026.
- Which products and versions are affected?
- Eclipse Otterdog.
- Is there a fix for CVE-2026-123870?
- Yes: fixed in Fixed in commit bbc9e3c and later; requires GITHUB_WEBHOOK_SECRET configuration. Until then: Configure GITHUB_WEBHOOK_SECRET with a strong secret value before deployment; the fix requires this to be set and enforces it at startup. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-123870 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-123870?
- Check whether you run Eclipse Otterdog. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Fixed in commit bbc9e3c and later; requires GITHUB_WEBHOOK_SECRET configuration
Configure GITHUB_WEBHOOK_SECRET with a strong secret value before deployment; the fix requires this to be set and enforces it at startup.
Technical details
The vulnerability exploits two issues: (1) a format-string built from GitHub webhook JSON body is passed to Python's eval() for dynamic execution, and (2) when GITHUB_WEBHOOK_SECRET is unset or empty, HMAC signature verification is skipped entirely. An unauthenticated network attacker can craft a malicious webhook request to reach the eval() sink with arbitrary Python code and execute commands on the webapp host.
Affected products
- Eclipse Otterdog
Timeline
- 2026-11-09: disclosed
- 2026: patched: Commit bbc9e3c replaces eval()-based filtering with callables and mandates webhook secret configuration