PT-2026-21844 · Olivetin · Olivetin

Byamb4 · Published 2026-02-25 · Updated 2026-03-03 · CVE-2026-27626

Positive Technologies · (AI Summary)

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OliveTin versions up to and including 3000.10.0

Description OliveTin, a tool designed to simplify shell command execution, has flaws in its shell command execution mechanism. The checkShellArgumentSafety function does not block the password argument type, allowing injection of shell metacharacters and arbitrary OS command execution. Additionally, webhook-extracted JSON values bypass type safety checks entirely before being passed to sh -c, leading to unauthenticated remote code execution (RCE) if the instance receives webhooks from external sources. Exploiting both vectors results in unauthenticated RCE on any OliveTin instance using Shell mode with webhook-triggered actions. The vulnerability stems from inadequate input validation and safety checks within the application. The vulnerable function is checkShellArgumentSafety. The vulnerable parameters are the password argument and webhook-extracted JSON values.

Recommendations Versions prior to 3000.10.0 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-27626

GHSA-49GM-HH7W-WFVF

GO-2026-4547

SUSE-SU-2026:0757-1

Affected Products

Olivetin

References · 122

• 🔥 https://github.com/OliveTin/OliveTin/security/advisories/GHSA-49gm-hh7w-wfvf · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27626.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-27626 · Security Note
• https://osv.dev/vulnerability/CVE-2026-27626 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-49gm-hh7w-wfvf · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4547 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/OliveTin/OliveTin · Note
• https://github.com/OliveTin/OliveTin/commit/4bbd2eab153287dc744ad061c58af7693f0c3ddc · Note
• https://twitter.com/CveFindCom/status/2026502792991404155 · Twitter Post
• https://suse.com/security/cve/CVE-2026-21435 · Note
• https://suse.com/security/cve/CVE-2026-24137 · Note
• https://suse.com/security/cve/CVE-2017-18873 · Note
• https://suse.com/security/cve/CVE-2026-22592 · Note
• https://suse.com/security/cve/CVE-2025-67860 · Note