{"metadata": {"vulnerability": "cve-2026-123717", "count": 9, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 4}, "linked_omitted": 0}, "data": [{"timestamp": "2026-11-06T10:30:25.846Z", "date_only": false, "value": "2026-11-06T10:30:25.846Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-123717", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-10T11:16:00Z", "date_only": false, "value": "2026-11-10T11:16:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / eclipse", "record": "cve-2026-123717", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T11:17:20.075Z", "date_only": false, "value": "2026-11-10T11:17:20.075Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-123717", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-10T11:17:20.075Z", "date_only": false, "value": "2026-11-10T11:17:20.075Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-123717", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-10T11:17:20.075Z", "date_only": false, "value": "2026-11-10T11:17:20.075Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / eclipse", "record": "cve-2026-123717", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-10T11:23:19.377Z", "date_only": false, "value": "2026-11-10T11:23:19.377319Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117591886974691474", "record": "CVE-2026-123717", "field": "creation_timestamp", "uuid": "0f6352d4-6f7f-4a00-8479-4e2270a84b18", "content": "CVE-2026-123717 [Eclipse CSI - otterdog] OS Command Injection and Arbitrary Code Execution OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through 1.7.1 allows a user able to modify an organization configuration to execute arbitrary commands with the privileges of the operator running otterdog, including access to their credential vault, via a crafted secret reference (pass:<path> or bitwarden:<item>@<field>) or credential identifier that is resolved when otterdog apply is run.\nhttps://www.cve.org/CVERecord?id=CVE-2026-123717https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-886p-g538-rcmphttps://github.com/eclipse-csi/otterdog/releases/tag/v1.8.0https://gitlab.eclipse.org/security/cve-assignment/-/work_items/552#eclipse #EclipseCSI #otterdog#CVE_2026_123717#bot", "url": "https://infosec.exchange/users/cve/statuses/117591886974691474"}, {"timestamp": "2026-11-10T12:17:17.380Z", "date_only": false, "value": "2026-11-10T12:17:17.380", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-123717", "record": "FKIE_CVE-2026-123717", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-10T12:17:17.380Z", "date_only": false, "value": "2026-11-10T12:17:17.380", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-123717", "record": "FKIE_CVE-2026-123717", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-11T03:50:03.070Z", "date_only": false, "value": "2026-11-11T03:50:03.070018Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzz2fjkn6z2f", "record": "CVE-2026-123717", "field": "creation_timestamp", "uuid": "93b013c6-3982-478b-97fd-2096b5aa8ced", "content": "CVE-2026-123717 - otterdog\nIf someone can change your Otterdog organization settings, they can make the tool run any command on the machine where it runs, potentially exposing your stored passwords. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#otterdog #eclipsecsi #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzz2fjkn6z2f"}], "metrics": {"as_of": "2026-11-12T05:38:55.582Z", "anchors": {"origin": {"timestamp": "2026-11-10T11:16:00Z", "date_only": false, "value": "2026-11-10T11:16:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / eclipse", "record": "cve-2026-123717", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-10T11:16:00Z", "date_only": false, "value": "2026-11-10T11:16:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / eclipse", "record": "cve-2026-123717", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 152575.582947, "hours": 42.38210637416666, "days": 1.765921098923611, "min_seconds": 152575.582947, "max_seconds": 152575.582947, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-10T11:16:00Z", "date_only": false, "value": "2026-11-10T11:16:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / eclipse", "record": "cve-2026-123717", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-12T05:38:55.582Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}