CVE-2026-123717: [Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution
OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to modify an organization configuration that Otterdog uses. The malicious value is executed when an operator runs otterdog apply.
What privileges could successful exploitation provide?
Commands run with the privileges of the operator running Otterdog. This can include access to that operator's credential vault.
Which credential-provider inputs are affected?
The affected inputs include crafted secret references for the pass provider in the form pass:<path>, Bitwarden references in the form bitwarden:<item>@<field>, and crafted credential identifiers.
How can I tell whether an environment may be exposed?
Review whether organization configurations can be modified by untrusted or insufficiently trusted users and whether those configurations contain pass or Bitwarden credential references or credential identifiers. Exposure occurs when such values are resolved during otterdog apply.