{"id":"CVE-2026-123717","published":"2026-11-10T12:17:17.380","lastModified":"2026-11-10T12:17:17.380","description":"OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/eclipse-csi/otterdog/releases/tag/v1.8.0","tags":[]},{"url":"https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmp","tags":[]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/552","tags":[]}],"exploitRefs":[{"url":"https://github.com/eclipse-csi/otterdog/releases/tag/v1.8.0","tags":[]},{"url":"https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmp","tags":[]}],"hasPoc":true,"ai":null}