OliveTin vulnerabilities
We track 8 vulnerabilities in OliveTin products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on July 29, 2026.
Latest OliveTin vulnerabilities
- 7.5 High severity
OliveTin: Uncontrolled Resource Consumption
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login requ
- 7.5 High severity
OliveTin: Concurrent Execution using Shared Resource with Improper Synchronization
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all gorou
- 8.5 High severity
OliveTin: Improper Limitation of a Pathname to a Restricted Directory
OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-suppl
- 8.8 High severity
OliveTin: Insufficient Verification of Data Authenticity
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience val
- 7.5 High severity
OliveTin: Missing Authorization
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correc
- 7.5 High severity
OliveTin: Concurrent Execution using Shared Resource with Improper Synchronization
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized acces
- 7.5 High severity
OliveTin: Uncontrolled Resource Consumption
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing m
- 9.9 Critical severity
OliveTin: Improper Neutralization of Special Elements used in an OS Command
OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkShellArgumentSafety`) blocks several dangerous argument types but not `password`. A user supplying a `