OliveTin CVE-2026-48709

Exploitation requires that the OliveTin configuration has AuthRequireGuestsToLogin explicitly set to true - the description labels this the 'security-conscious configuration,' implying it is not the default state. Without this setting, unauthenticated access to OliveTin endpoints is already expected, and the missing authorization on ValidateArgumentType provides no additional attacker advantage. The attacker must have TCP network access to the OliveTin web interface port. Exploitation is strictly limited to information disclosure of action binding IDs and argument type configurations - there is no authentication bypass to other endpoints, no command execution, no integrity impact, and no availability impact. The non-default configuration prerequisite is the primary factor limiting real-world exposure and is reflected in the CVSS AC:H metric.

The CVSS 3.1 score of 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N correctly characterizes this as a low-priority finding. AC:H reflects the conditional nature of exploitation: the bypass only provides attacker value when AuthRequireGuestsToLogin is enabled, since open instances already permit unauthenticated access everywhere. The confidentiality impact is bounded to action binding IDs and argument type metadata - no credentials, secrets, or shell output are disclosed. No EPSS score was supplied in the input, so exploitation probability cannot be quantified; however, the vendor's own release notes classify this advisory (GHSA-f637-w7p2-m7fx) as LOW severity, the vulnerability is absent from CISA KEV, and no public POC has been identified. The practical risk is reconnaissance uplift: an attacker enumerates the command surface of the target OliveTin instance, which could inform a follow-on attack if a separate vulnerability (e.g., injection in a command argument) exists. Internet-exposed instances with sensitive commands configured should treat this as more urgent than the raw score implies.

An unauthenticated attacker with HTTP access to an OliveTin instance configured with AuthRequireGuestsToLogin enabled sends iterative requests to the ValidateArgumentType RPC endpoint, probing candidate action binding IDs. The endpoint returns validation responses that confirm whether an ID is valid and reveal the associated argument type schema, allowing the attacker to reconstruct the full set of configured shell commands and their input parameters without any credentials. This enumeration could then be used to identify high-value or sensitive commands (e.g., those accepting file paths or system identifiers) for targeting in a subsequent injection or abuse scenario.