Olivetin
CVE-2026-28342
HIGH
GHSA-pc8g-78pf-4xrp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend concurrent password hashing requests
-
ExploitTrigger excessive memory allocation
-
ExecutionExhaust container memory
-
ImpactService degradation or complete denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | OliveTin versions prior to 3000.10.2 with unauthenticated access to the PasswordHash API endpoint. No authentication required; default deployment exposes vulnerable endpoint to remote attackers. |
| Impact | CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None. Exploitation no authentication required. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker without authentication could exploit this vulnerability to trigger excessive memory allocation by sending concurrent password hashing reque. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OliveTin versions prior to 3000.10.2 are vulnerable to unauthenticated denial of service through the PasswordHash API endpoint, which lacks request throttling or authentication controls and allows attackers to trigger excessive memory allocation via concurrent hashing requests. An attacker can exhaust container memory by sending multiple parallel requests, causing service degradation or complete outage. Public exploit code exists for this vulnerability, and a patch is available in version 3000.10.2 and later.
Earlier versions of this analysis (1)
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. [CVSS 7.5 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 3000.10.2.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-400 (Uncontrolled Resource Consumption). Affects Olivetin. OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing o
Know when Olivetin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2.
Executive ViewAI
OliveTin instances are vulnerable to denial-of-service attacks that allow unauthenticated attackers to exhaust server memory and take systems offline. Any organization running OliveTin versions prior to 3000.10.2 faces immediate risk of service disruption, particularly if OliveTin controls critical infrastructure or operational processes.
Apply vendor patch. Interim mitigations if patching is delayed: implement WAF rules to rate-limit the PasswordHash API endpoint, restrict network access to OliveTin web interface via IP allowlisting, or disable the PasswordHash API feature if not operationally required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in OliveTin Web Interface Authentication Issues
View all 3OS command injection in OliveTin web shell interface through version 3000.10.0. OliveTin provides web-based access to pr
OliveTin gives access to predefined shell commands from a web interface. [CVSS 8.8 HIGH]
Arbitrary file write in OliveTin prior to 3000.11.2 allows authenticated attackers to write files to arbitrary filesyste
Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated at
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/a
OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary s
OliveTin prior to version 3000.11.1 fails to enforce view permission checks on dashboard and API endpoints, allowing aut
OliveTin prior to version 3000.11.1 fails to invalidate server-side sessions upon user logout, allowing attackers with a
OliveTin versions prior to 3000.11.1 contain an authentication bypass in RestartAction that allows authenticated users t
Concurrent action execution in OliveTin versions 3000.0.0 and prior triggers a race condition in a shared text/template.
Exploit-DB