External risk intelligence

Otterdog Webapp Arbitrary Python Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-123870

The vulnerability exists in a web application designed to receive GitHub webhooks. Such services are typically deployed as internet-facing endpoints or edge listeners to process incoming requests from GitHub's servers, making them commonly reachable from the public internet in standard deployment configurations.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the otterdog web application that allows for unauthenticated remote code execution. The issue arises when a specific security configuration is not properly set, bypassing signature checks and enabling attackers to inject and run arbitrary Python code on the affected host.

Web app allows code execution via unauthenticated requests.
Critical risk if a common security setting is not configured.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable web application over the network without needing any credentials. If the application's secret configuration is not set, the attacker can send specially crafted webhook data, bypassing signature checks and allowing them to execute arbitrary Python code on the host.

Unauthenticated network access
Send malicious webhook payload
Execute arbitrary code on host

Live Threat

Current exploitation, exposure, and threat context

When the `GITHUB_WEBHOOK_SECRET` configuration is unset or empty, an unauthenticated attacker can send a specially crafted GitHub webhook JSON payload to the web application. This payload can be processed by an `eval()` function, allowing arbitrary Python code execution on the host system running the web application.

Arbitrary Python code execution.
Network input bypasses signature check.
Host system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The otterdog webapp, when processing GitHub webhooks with an unset secret, allows unauthenticated attackers to execute arbitrary Python code on the host. Identifying all instances of this webapp, confirming their accessibility and business criticality, and then assigning an accountable owner for remediation planning is the critical first step.

Application owners should manage this issue.
Verify webhook secret configuration and network reachability.
Plan remediation based on exposure and business impact.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the otterdog webapp?

Otterdog is a specialized web application used for managing and automating workflows via GitHub webhooks. It acts as a listener that processes incoming JSON data from GitHub to coordinate tasks. Organizations rely on it to bridge their internal systems with GitHub events, meaning it is typically deployed where it can actively receive network traffic from the internet or directly from GitHub's servers.

What does CWE-95 mean for CVE-2026-123870?

CWE-95 refers to Improper Neutralization of Directives in Dynamically Evaluated Code, commonly known as an eval() injection vulnerability. In this case, the application takes input from a webhook and processes it using Python's eval() function. Because the input is not sanitized, the application mistakenly treats malicious data as legitimate commands, allowing an attacker to run their own unauthorized Python code on your server.

How is this vulnerability triggered?

The flaw is triggered when the GITHUB_WEBHOOK_SECRET is not configured. When this secret is missing or empty, the application skips its signature verification process, which is the mechanism intended to ensure requests only come from GitHub. Without this gatekeeper, the application accepts any incoming JSON payload from any source and passes it directly to the vulnerable evaluation function.

Is my installation at risk?

According to Halo Surface Signal, this software is often deployed as an internet-facing endpoint to receive events, making it a high-priority concern if reachable from the public web. If your instance is exposed to the internet and lacks the required secret configuration, it is highly accessible to attackers. You should evaluate your network perimeter to determine if the application is reachable by unauthorized external traffic.

Do I need to secure my otterdog instance now?

Yes, you should prioritize this. Begin by identifying all instances of the application and verifying if the GITHUB_WEBHOOK_SECRET is currently set. If it is unset, the application is vulnerable. Coordinate with your team to review the configuration, ensure appropriate secrets are enforced, and assess the business impact of the affected system to plan a formal remediation path.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.