TI-2026-35990 Aliases CVE-2026-48709 GHSA-f637-w7p2-m7fx

OliveTin: ValidateArgumentType API Endpoint Missing Authentication Allows Action and Argument Enumeration

MEDIUM 51CWE-862Published 2026-06-15 · Updated 2026-06-24

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00329 26th percentileScored 2026-11-07

Fix Fixed OliveTin (OliveTin): 3000.13.0github.com/OliveTin/OliveTin (Go): 0.0.0-20260521230847-a3865704c854

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OliveTin	OliveTin	before 3000.13.0	3000.13.0	Patch available	CNA
—	github.com/OliveTin/OliveTin (Go)	before 0.0.0-20260521230847-a3865704c854	0.0.0-20260521230847-a3865704c854	Patch available	GHSA-f637-w7p2-m7fx

OliveTin VendorOliveTin Affected before 3000.13.0 Fixed in 3000.13.0 Patch available CNA
github.com/OliveTin/OliveTin (Go) Vendor— Affected before 0.0.0-20260521230847-a3865704c854 Fixed in 0.0.0-20260521230847-a3865704c854 Patch available GHSA-f637-w7p2-m7fx

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:olivetin:olivetin::::::::	—	—	OliveTin

cpe:2.3:a:olivetin:olivetin:*:*:*:*:*:*:*:* Versions — — ·OliveTin

Remediation

Fix · CNA OliveTin (OliveTin) Fixed in 3000.13.0
Fix · GHSA-f637-w7p2-m7fx github.com/OliveTin/OliveTin (Go) Fixed in 0.0.0-20260521230847-a3865704c854 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-48709
2026-10-03 Alias added: GHSA-f637-w7p2-m7fx

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-48709

Other 4

TI-2026-23456 OliveTin: JWT Audience Validation Bypass in Local Key and HMAC Modes CVSS 3.1HIGH 8.8
TI-2026-22008 OS command injection in OliveTin CVSS 3.1CRITICAL 10.0
TI-2026-47717 OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth) CVSS 3.1HIGH 7.5
TI-2026-22985 OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login CVSS 3.1HIGH 7.5
TI-2026-22984 OliveTin: Unauthenticated DoS via concurrent map writes in OAuth2 state handling CVSS 3.1HIGH 7.5
TI-2026-22627 OliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint CVSS 3.1HIGH 7.5

See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences