Github.Com Olivetin Olivetin vulnerabilities

CVE-2026-27626 [CRITICAL] CWE-78 OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks OliveTin: OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks ### Summary OliveTin's shell mode safety check (`checkShellArgumentSafety`) blocks several dangerous argument types but not `password`. A user supplying a `password`-typed argument can inject shell metacharacters that execute arbit

CVE-2026-31817 [HIGH] CWE-22 OliveTin's unsafe parsing of UniqueTrackingId can be used to write files OliveTin's unsafe parsing of UniqueTrackingId can be used to write files When the `saveLogs` feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-supplied `UniqueTrackingId` field in the `StartAction` API request. This value is not validated or sanitized before being used in a file path, allowing an attac

CVE-2026-30223 [HIGH] CWE-287 OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes OliveTin has JWT Audience Validation Bypass in Local Key and HMAC Modes ### Summary When JWT authentication is configured using either: - `authJwtPubKeyPath` (local RSA public key), or - `authJwtHmacSecret` (HMAC secret), the configured audience value (`authJwtAud`) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect `aud` claim are accepted for aut

CVE-2026-48708 [HIGH] CWE-362 OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination ## Summary OliveTin's template engine uses a **single shared `text/template.Template` instance** (`tpl` package-level variable in `service/internal/tpl/templates.go`) across all goroutines. Every action execution calls `tpl.Parse(source)` followed by

CVE-2026-28342 [HIGH] CWE-400 OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint OliveTin has Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint ## Summary The PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degr

CVE-2026-28790 [HIGH] CWE-284 OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login ### Summary OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release (3000.10.2), guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and succe

CVE-2026-28789 [HIGH] CWE-362 OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling OliveTin has unauthenticated DoS via concurrent map writes in OAuth2 state handling ### Summary An unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This

CVE-2025-50946 [HIGH] CWE-78 OliveTin OS Command Injection vulnerability OliveTin OS Command Injection vulnerability OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.

CVE-2026-32102 [HIGH] CWE-284 OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream OliveTin Vulnerable to Unauthorized Action Output Disclosure via EventStream ### Summary OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitiv

CVE-2026-30224 [MEDIUM] CWE-384 OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session OliveTin Session Fixation: Logout Fails to Invalidate Server-Side Session ### Summary OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a previously stolen or captured session cookie can continue authenticating after logout, r

CVE-2026-30225 [MEDIUM] CWE-250 OliveTin's RestartAction always runs actions as guest OliveTin's RestartAction always runs actions as guest ### Summary An authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request without preserving the original caller’s authentication headers or cookies. When this synthetic request is passed to StartAction,

CVE-2026-30233 [MEDIUM] CWE-200 OliveTin doesn't check view permission when returning dashboards OliveTin doesn't check view permission when returning dashboards ### Summary An authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the backend does not enforce IsAllowedView() when constructing dashboard and action binding responses. As a r

CVE-2026-48709 [LOW] CWE-862 OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration OliveTin: ValidateArgumentType API Endpoint's Missing Authentication Allows Action and Argument Enumeration ## Summary The `ValidateArgumentType` RPC endpoint in `service/internal/api/api.go` does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call `auth.UserFromApiCall` or `checkDashboardAcc

CVE-2026-53541 [MEDIUM] CWE-20 OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering OliveTin has Unvalidated `ot_`-prefixed Arguments that Bypass Input Filtering ### Description The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, a special case allows any argument whose name starts with `ot_` to bypass this filter. While two system arguments (`ot_executionTrackin