CVE-2026-27626-PoC

OliveTin is a self-hosted web UI for exposing predefined shell commands to end users. This repository contains a proof-of-concept demonstrating two independent OS command injection vectors in OliveTin's Shell mode execution path, both of which bypass the application's intended shell-argument safety checks.

Background

OliveTin lets an admin define Actions — shell commands with parameterized arguments — that authenticated (or, depending on config, anonymous) users can trigger from a web UI or via webhooks. To prevent users from breaking out of the intended command via argument values, OliveTin runs every user-supplied argument through checkShellArgumentSafety() before templating it into a command string and handing it to sh -c.

This is the security boundary the vulnerability breaks. OliveTin explicitly distinguishes "admin defines the command" from "user supplies the value" — the safety check exists specifically so a user can't turn an argument value into a way to run arbitrary commands.

Root Cause

Vector 1 — password argument type is unchecked

checkShellArgumentSafety() only sanitizes a fixed allow-list of argument types:

password is a documented, intended argument type for accepting sensitive user input — but it isn't in dangerousTypes, so it falls through to return true unsanitized. Any user able to populate a password-typed argument on a Shell-mode Action can inject shell metacharacters (;, |, `, $(), etc.) that execute arbitrary commands as the OliveTin process user.

Exploitability here is amplified by OliveTin's defaults: self-registration is enabled and authType: none out of the box, so in many real deployments "authenticated user" requires no real barrier at all.

Vector 2 — Webhook JSON extraction skips type checking entirely

Independent of Vector 1, OliveTin's webhook handler extracts arbitrary key/value pairs from an inbound webhook's JSON body and injects them directly into ExecutionRequest.Arguments (service/internal/executor/handler.go:153-157).

Because these webhook-derived keys have no corresponding ActionArgument defined in the action's config, parseActionArguments() (arguments.go) finds no argument type to check against and skips checkShellArgumentSafety() entirely — not just for password, but for every type. The raw value is templated into the shell command and passed to sh -c with zero validation.

Since receiving inbound webhooks from external/untrusted sources is one of OliveTin's primary supported use cases, this vector requires no authentication at all.

Combined impact

An OliveTin instance running Shell mode with any webhook-triggered Action is vulnerable to unauthenticated remote code execution, with the privileges of the OliveTin process — potentially full host compromise depending on how OliveTin is deployed (bare metal vs. container, capabilities granted, etc.).

Affected Configuration

You are likely vulnerable if your OliveTin instance:

• Runs Actions in Shell mode, and
• Has at least one Action with a password-typed argument exposed to untrusted/lower-privileged users (Vector 1), or
• Has any Action triggerable via webhook, particularly one reachable from outside your trust boundary (Vector 2)

Usage

Arguments

Impact

• Arbitrary OS command execution as the OliveTin service account
• Full compromise of the host or container running OliveTin
• Lateral movement into any environment OliveTin can reach (it commonly runs with elevated access to manage other services)
• Vector 2 enables this with zero credentials, against any internet-facing instance accepting webhooks

Remediation

1. Upgrade OliveTin to 0.0.0-20260222101908-4bbd2eab1532 or later as soon as it's available in your update channel.
2. Until patched:
   • Disable Shell mode if it isn't required.
   • Avoid using webhook-triggered Actions in Shell mode.
   • Remove or avoid password-typed arguments on any Action reachable by untrusted users.
   • Disable self-registration and enforce real authentication (authType other than none).
   • Restrict network access to OliveTin's webhook endpoint to trusted sources only (firewall/reverse-proxy allow-listing).
   • Run OliveTin in a container with a minimal capability set and a restrictive seccomp profile to limit blast radius even if exploited.
   • Monitor OliveTin process logs / host audit logs for unexpected child processes spawned by the OliveTin service.

Timeline

References

• GitHub Security Advisory: GHSA-49gm-hh7w-wfvf
• NVD: CVE-2026-27626
• OliveTin project: github.com/OliveTin/OliveTin

Responsible Use

This PoC is published for defensive research, detection-engineering, and authorized penetration testing purposes only. Do not run it against systems you do not own or do not have explicit written authorization to test. Misuse of this code against third-party systems may violate computer crime laws (e.g., CFAA in the US, Computer Misuse Act in the UK, and equivalent statutes elsewhere) and is solely the responsibility of the person executing it.

Author

Md Saikat (0xh7ml)