Olivetin
CVE-2026-30223
HIGH
GHSA-g962-2j28-3cg9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid JWT token from different audience
-
ExploitCraft malicious request with mismatched aud claim
-
ExecutionOliveTin accepts token without verification
-
ImpactExecute arbitrary shell commands via web interface
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | OliveTin versions before 3000.11.1 with JWT authentication enabled using authJwtPubKeyPath or authJwtHmacSecret. Attacker requires valid JWT token (even if issued for different audience). No special network access or default configuration required beyond JWT auth being active. |
| Impact | CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitable via local access. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
OliveTin gives access to predefined shell commands from a web interface. [CVSS 8.8 HIGH]
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 3000.11.1.. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-287 (Improper Authentication). Affects Olivetin. OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. Thi
Know when Olivetin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" (local RSA public key) or "authJwtHmacSecret" (HMAC secret), the configured audience value (authJwtAud) is not enforced during token parsing. As a result, validly signed JWT tokens with an incorrect aud claim are accepted for authentication. This allows authentication using tokens intended for a different audience/service. This issue has been patched in version 3000.11.1.
Executive ViewAI
OliveTin, a web-based command execution tool, contains a critical vulnerability (CVSS 8.8) that allows attackers to execute arbitrary shell commands through the web interface. Active exploits exist in the wild, creating immediate risk to any organization running this software. This poses significant operational and security risk as compromised systems could be used for lateral movement, data exfiltration, or infrastructure sabotage.
Apply vendor patch. If patching cannot be completed immediately: (1) restrict network access to OliveTin web interface using firewall rules to trusted administrative networks only, (2) implement reverse proxy WAF rules to block suspicious command patterns, (3) disable OliveTin service until patching is complete, (4) monitor all process execution and network connections from OliveTin processes for anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in OliveTin Authentication Flaws
View all 4OS command injection in OliveTin web shell interface through version 3000.10.0. OliveTin provides web-based access to pr
Arbitrary file write in OliveTin prior to 3000.11.2 allows authenticated attackers to write files to arbitrary filesyste
Memory-exhaustion denial of service in OliveTin (versions 3000.0.0 through 3000.16.x) allows a remote unauthenticated at
OliveTin versions prior to 3000.10.2 are vulnerable to unauthenticated denial of service through the PasswordHash API en
OliveTin versions prior to 3000.10.3 are vulnerable to unauthenticated denial-of-service attacks when OAuth2 authenticat
OliveTin versions prior to 3000.11.0 suffer from broken access control allowing unauthenticated users to invoke the Kill
OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/a
OS command injection in OliveTin versions 3000.2.0 through 3000.16.x allows an authenticated user to execute arbitrary s
Concurrent action execution in OliveTin versions 3000.0.0 and prior triggers a race condition in a shared text/template.
Exploit-DB