| CVE-2026-53541 | MEDIO4.3 | OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any arg | 21/08/2026 |
| CVE-2026-67439 | MEDIO4.3 | OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission bu | 29/07/2026 |
| CVE-2026-67438 | MEDIO6.6 | OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass typeSafetyCheckRegex to be interpol | 29/07/2026 |
| CVE-2026-67437 | ALTO7.5 | OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowin | 29/07/2026 |
| CVE-2026-48709 | BAJO3.7 | OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall | 15/06/2026 |
| CVE-2026-48708 | ALTO7.5 | OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level variable in service/internal/tpl/templates.go) across all goroutines. Every action execution calls tpl.Parse(source) follow | 15/06/2026 |
| GO-2026-4687 | — | OliveTin's email argument makes compliance harder, enables log injection in github.com/OliveTin/OliveTin | 12/03/2026 |
| GHSA-xx6g-43w2-9g6g | MEDIO | OliveTin's email argument makes compliance harder, enables log injection | 12/03/2026 |
| CVE-2026-32102 | MEDIO6.5 | OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from acti | 11/03/2026 |
| CVE-2026-31817 | ALTO8.5 | OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-supplied UniqueTrackingId field in the StartAction API request. T | 10/03/2026 |
| GO-2026-4621 | — | OliveTin has crash on NPE by calling APIs with invalid bindings or log references in github.com/OliveTin/OliveTin | 10/03/2026 |
| CVE-2026-30233 | MEDIO4.3 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authorization flaw in OliveTin allows authenticated users with view: false permission to enumerate action bindings and metadata via dashboard and API endpoints. Although execution (exec) may be correctly denied, the | 06/03/2026 |
| CVE-2026-30225 | MEDIO4.3 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new internal connect.Request wit | 06/03/2026 |
| CVE-2026-30224 | MEDIO5.4 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry (default ≈ 1 year). An attacker with a p | 06/03/2026 |
| CVE-2026-30223 | ALTO8.8 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a r | 06/03/2026 |
| GHSA-fwhj-785h-43hh | MEDIO5.3 | OliveTin has crash on NPE by calling APIs with invalid bindings or log references | 05/03/2026 |
| CVE-2026-28790 | ALTO7.5 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the Ki | 05/03/2026 |
| CVE-2026-28789 | ALTO7.5 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime pan | 05/03/2026 |
| CVE-2026-28342 | ALTO7.5 | OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available | 05/03/2026 |
| CVE-2026-27626 | CRÍTICO9.9 | OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkShellArgumentSafety`) blocks several dangerous argument types but not `password`. A user supplying a `password`-typed argument can inject shell metacharacters tha | 25/02/2026 |