# CVE-2026-123870: Otterdog webhook arbitrary code execution via eval()

Source: https://junglewise.ai/threats/cve-2026-123870-the-otterdog-webapp-evaluates-a-format-string-built-from-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-123870 · Severity: info · Published 2026-11-09

Otterdog is a Python webapp that manages GitHub organization settings via webhooks. When the webhook secret configuration is missing or empty (the default), the application skips signature validation and allows an attacker to send malicious JSON payloads that are evaluated as Python code, enabling remote code execution on the server without authentication.

Vendors: [Eclipse](https://junglewise.ai/threats/vendors/eclipse).

## Quick answers

**Is CVE-2026-123870 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123870 being exploited in the wild.

**How severe is CVE-2026-123870?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Eclipse Otterdog.

**Is there a fix for CVE-2026-123870?** Yes: fixed in Fixed in commit bbc9e3c and later; requires GITHUB_WEBHOOK_SECRET configuration. Until then: Configure GITHUB_WEBHOOK_SECRET with a strong secret value before deployment; the fix requires this to be set and enforces it at startup. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123870 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-123870?** Check whether you run Eclipse Otterdog. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fixed in commit bbc9e3c and later; requires GITHUB_WEBHOOK_SECRET configuration

Configure GITHUB_WEBHOOK_SECRET with a strong secret value before deployment; the fix requires this to be set and enforces it at startup.

## Technical details

The vulnerability exploits two issues: (1) a format-string built from GitHub webhook JSON body is passed to Python's eval() for dynamic execution, and (2) when GITHUB_WEBHOOK_SECRET is unset or empty, HMAC signature verification is skipped entirely. An unauthenticated network attacker can craft a malicious webhook request to reach the eval() sink with arbitrary Python code and execute commands on the webapp host.

## Affected products

- Eclipse Otterdog

## Timeline

- 2026-11-09: disclosed
- 2026: patched: Commit bbc9e3c replaces eval()-based filtering with callables and mandates webhook secret configuration

## References

- [https://pypi.org/](https://pypi.org/)
- [https://github.com/eclipse-csi/otterdog/commit/bbc9e3ced3665f09fc4632f11b5867524eda7f72](https://github.com/eclipse-csi/otterdog/commit/bbc9e3ced3665f09fc4632f11b5867524eda7f72)