CVE-2026-27626: OliveTin OS command injection via password arguments and webhook JSON
OliveTin has two independent OS command injection vectors that bypass the shell mode safety check, one through the password argument type and one through JSON values extracted from webhooks. The record states that the two vectors together enable unauthenticated remote code execution on instances using Shell mode with webhook-triggered actions. No patched version was available at publication, and CISA KEV does not list the CVE.
Overview
OliveTin provides access to predefined shell commands through a web interface. The record describes two independent vectors that bypass the shell mode safety check: the password argument type, and values extracted from webhook JSON before they reach the shell.
Impact
According to the record, an authenticated user exploiting the first vector can run arbitrary OS commands on the OliveTin host with the permissions of the OliveTin process. Through the second vector, an unauthenticated attacker can achieve the same when the instance receives webhooks from external sources. Combined, the record states this yields unauthenticated remote code execution on instances using Shell mode with webhook-triggered actions. The weakness is classified as CWE-78, OS Command Injection.
Affected products and versions
- Product: OliveTin (Olivetin Olivetin in the record).
- Affected: up to and including 3000.10.0.
- Fixed version: none listed in the record. The record states that a patched version was not available at publication.
Exploitation status
CISA KEV does not list this CVE, so no confirmed active exploitation appears in the sources consulted. The SSVC record marks exploitation as poc, which indicates proof-of-concept activity. The EPSS probability is 0.00728 with a percentile of 0.53705. The advisory reference is tagged as Exploit, so prioritize this issue without treating it as confirmation of attacks.
Remediation and mitigation
- Restrict access to the OliveTin web interface and do not expose it to untrusted networks.
- Disable open registration and use an authentication mode other than none where feasible.
- Limit webhook sources to trusted senders and review which actions webhooks can trigger.
- Avoid Shell mode for actions that accept external or user-supplied input where alternatives exist.
- Run the OliveTin process with least privilege.
- Follow the GitHub security advisory and upgrade once a patched release is published.
Detection guidance
- Review OliveTin logs for executions involving password-type arguments or unusual special characters in parameters, at a high level.
- Monitor for unexpected child processes started by the OliveTin service account.
- Audit webhook-triggered executions and the source addresses that initiated them.
Limitations of the available information
The record does not provide a fixed version, patch details, or information about specific deployments. The EPSS date in the record is 2026-10-23, which should be verified against the source. This analysis relies on the record and the cited references, and the full advisory text was not reviewed directly.
Frequently asked questions
Which OliveTin versions are affected?
The record lists versions up to and including 3000.10.0 as affected. No fixed version is listed in the sources, and the record states that a patched version was not available at publication.
Is this vulnerability being actively exploited?
CISA KEV does not list this CVE, so no confirmed active exploitation appears in the sources consulted. The SSVC record marks exploitation as poc, which indicates proof-of-concept activity.
What can defenders do now?
Restrict access to the web interface, disable open registration, limit webhook sources to trusted senders, avoid Shell mode where alternatives exist, run the process with least privilege, and upgrade once a patch is published.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.