OS Command Injection Vulnerability in Eclipse Otterdog by Eclipse Foundation

CVE-2026-123717

What is CVE-2026-123717?

A vulnerability has been identified in Eclipse Otterdog, allowing for OS command injection through the pass and Bitwarden credential providers. Users with the ability to modify organization configurations can potentially execute arbitrary commands by leveraging crafted secret references or credential identifiers. This can lead to unauthorized access to sensitive information within the credential vault as the operator privileges are exploited when the otterdog apply command is executed.

References