How do I check whether I am affected by CVE-2026-123870?

- Check whether the webapp's environment sets GITHUB_WEBHOOK_SECRET to a non-empty value; unset or empty means exposed. - Confirm you run the otterdog webapp (from the repository/container), not just the PyPI otterdog package, which the advisory says is not affected. - Compare your version with the advisory's affected range (>= 0.9.0, < 1.3.2) and check whether your build includes commit bbc9e3c.

Post Share

CRITICAL9.5CVSS · emo@eclipse.org

NO KNOWN
EXPLOIT

OTTERDOG-WEBAPP · CVE-2026-123870 · Other

otterdog webapp: unsigned GitHub webhooks let attackers run Python code

Q: Who is not affected by CVE-2026-123870?

Not affected if: endpoint-not-exposed, pypi-package-only, webhook-secret-set.

NO FIX YET · SEE WHAT TO DO

The otterdog webapp builds a format string from incoming GitHub webhook JSON and evaluates it with Python's eval(). When GITHUB_WEBHOOK_SECRET is unset or empty, the signature check is skipped, so an unauthenticated network client can execute arbitrary Python on the host.

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

Teams that self-host the otterdog webapp (eclipse-csi/otterdog) and receive GitHub webhooks at it. It is exploitable when GITHUB_WEBHOOK_SECRET is unset or empty, which skips signature checking and lets an unauthenticated client reach eval() through the webhook's action field. The advisory says the PyPI otterdog package is not affected because the webapp is excluded from the wheel. Deployments with a non-empty secret, or without a network-reachable webhook endpoint, can skip it.

otterdog-webapp>= 0.9.0, < 1.3.2 (advisory also says current main)

Not affected if endpoint-not-exposed, pypi-package-only, webhook-secret-set

Who cares github-webhooks, otterdog, python, self-hosted

02 · How to check

✓ Verified Nov 9

Check whether the webapp's environment sets GITHUB_WEBHOOK_SECRET to a non-empty value; unset or empty means exposed.
Confirm you run the otterdog webapp (from the repository/container), not just the PyPI otterdog package, which the advisory says is not affected.
Compare your version with the advisory's affected range (>= 0.9.0, < 1.3.2) and check whether your build includes commit bbc9e3c.

03 · The fix

Commit bbc9e3c on eclipse-csi/otterdog makes GITHUB_WEBHOOK_SECRET mandatory (startup fails if unset or empty) and replaces the eval() filter with callables

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

3 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202609:00 UTCgithub.com Vendor advisory: github.com
Nov 9, 202609:25 UTCNVD CVE-2026-123870
Nov 9, 202609:27 UTCInfraStack Analyst Read GHSA-32xf-7j44-xq72 and fix commit bbc9e3c via WebFetch (web-cli out of Exa credits, so no posts search). Advisory is inconsistent: lists patched 1.3.3 and affected <1.3.2 but also says unpatched on default branch. Commit makes secret mandatory and drops eval. No release tag confirmed, so fix not verified.

What the sources say, verbatim

408 characters

The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.

Sources and references

NVD: CVE-2026-123870Nov 9, 2026
Patch: github.comFix · github.com
Vendor advisory: github.comAdvisory · github.com

This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Otterdog-webapp threat the day it hits your stack.

Start free

Post Share

CRITICAL9.5CVSS · emo@eclipse.org

NO KNOWN
EXPLOIT

OTTERDOG-WEBAPP · CVE-2026-123870 · Other

otterdog webapp: unsigned GitHub webhooks let attackers run Python code

NO FIX YET · SEE WHAT TO DO

first public Nov 9, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

otterdog-webapp>= 0.9.0, < 1.3.2 (advisory also says current main)

Not affected if endpoint-not-exposed, pypi-package-only, webhook-secret-set

Who cares github-webhooks, otterdog, python, self-hosted

02 · How to check

✓ Verified Nov 9

Check whether the webapp's environment sets GITHUB_WEBHOOK_SECRET to a non-empty value; unset or empty means exposed.
Confirm you run the otterdog webapp (from the repository/container), not just the PyPI otterdog package, which the advisory says is not affected.
Compare your version with the advisory's affected range (>= 0.9.0, < 1.3.2) and check whether your build includes commit bbc9e3c.

03 · The fix

Commit bbc9e3c on eclipse-csi/otterdog makes GITHUB_WEBHOOK_SECRET mandatory (startup fails if unset or empty) and replaces the eval() filter with callables

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 9, 2026

How it unfolded

3 events · Nov 9, 2026 → Nov 9, 2026

Nov 9, 202609:00 UTCgithub.com Vendor advisory: github.com
Nov 9, 202609:25 UTCNVD CVE-2026-123870
Nov 9, 202609:27 UTCInfraStack Analyst Read GHSA-32xf-7j44-xq72 and fix commit bbc9e3c via WebFetch (web-cli out of Exa credits, so no posts search). Advisory is inconsistent: lists patched 1.3.3 and affected <1.3.2 but also says unpatched on default branch. Commit makes secret mandatory and drops eval. No release tag confirmed, so fix not verified.

What the sources say, verbatim

408 characters

Sources and references

NVD: CVE-2026-123870Nov 9, 2026
Patch: github.comFix · github.com
Vendor advisory: github.comAdvisory · github.com

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Are you affected?

Tell InfraStack what you run. It checks this one, and every next one, against your stack.

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

In Slack

Run the check

Get the next Otterdog-webapp threat the day it hits your stack.

Start free

otterdog webapp: unsigned GitHub webhooks let attackers run Python code

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Otterdog-webapp threat the day it hits your stack.

otterdog webapp: unsigned GitHub webhooks let attackers run Python code

01 · Who is affected

02 · How to check

03 · The fix

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Otterdog-webapp threat the day it hits your stack.