---
id: "CVE-2026-123870"
page: "https://infrastack.ai/live/CVE-2026-123870"
kind: "vulnerability"
aliases: ["CVE-2026-123870"]
title: "otterdog webapp: unsigned GitHub webhooks let attackers run Python code"
severity: "critical"
cvss: 9.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "otterdog-webapp", "fixed": [], "affected": ">= 0.9.0, < 1.3.2 (advisory also says current main)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["github-webhooks", "other", "otterdog", "python", "self-hosted"]
not_affected_if: ["endpoint-not-exposed", "pypi-package-only", "webhook-secret-set"]
published_at: "2026-11-09T09:16:58+00:00"
first_seen_at: "2026-11-09T09:25:32+00:00"
updated_at: "2026-11-09T09:27:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123870", "first_seen_at": "2026-11-09T09:25:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-09T09:27:43+00:00"}]
exploit_sources: []
---

# otterdog webapp: unsigned GitHub webhooks let attackers run Python code

Link for people: https://infrastack.ai/live/CVE-2026-123870 (this .md is for agents)

The otterdog webapp builds a format string from incoming GitHub webhook JSON and evaluates it with Python's eval(). When GITHUB_WEBHOOK_SECRET is unset or empty, the signature check is skipped, so an unauthenticated network client can execute arbitrary Python on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:otterdog-webapp affected >= 0.9.0, < 1.3.2 (advisory also says current main) fixed no fixed version listed

## How to check

- Check whether the webapp's environment sets GITHUB_WEBHOOK_SECRET to a non-empty value; unset or empty means exposed.
- Confirm you run the otterdog webapp (from the repository/container), not just the PyPI otterdog package, which the advisory says is not affected.
- Compare your version with the advisory's affected range (>= 0.9.0, < 1.3.2) and check whether your build includes commit bbc9e3c.

## Fix

Commit bbc9e3c on eclipse-csi/otterdog makes GITHUB_WEBHOOK_SECRET mandatory (startup fails if unset or empty) and replaces the eval() filter with callables. The advisory lists 1.3.3 as patched but also says no fix is on the default branch; no release containing the commit is confirmed. Until you can confirm a release, set a non-empty GITHUB_WEBHOOK_SECRET (matching the GitHub webhook secret) or do not expose the endpoint.

## Timeline

- 2026-11-09T09:25:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123870
- 2026-11-09T09:27:43+00:00 analyst — Read GHSA-32xf-7j44-xq72 and fix commit bbc9e3c via WebFetch (web-cli out of Exa credits, so no posts search). Advisory is inconsistent: lists patched 1.3.3 and affected <1.3.2 but also says unpatched on default branch. Commit makes secret mandatory and drops eval. No release tag confirmed, so fix not verified.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-32xf-7j44-xq72
- [fix] Patch: github.com https://github.com/eclipse-csi/otterdog/commit/bbc9e3ced3665f09fc4632f11b5867524eda7f72

## From the sources

The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval(). When the GITHUB_WEBHOOK_SECRET configuration value is unset or empty (the code default is None), the HMAC signature check is skipped entirely, allowing an unauthenticated network client to reach the eval() sink with attacker-controlled input and execute arbitrary Python on the webapp host.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_