OliveTin CVE-2026-67438

Exploitation requires all of the following: (1) OliveTin version 3000.2.0 through 3000.16.x must be running; (2) at least one action in config.yaml must be defined using the shell: key (Shell mode), not the exec: list format; (3) that Shell-mode action must declare an argument with a type prefixed by regex: (custom regex validation); (4) the attacker must have OliveTin-level access sufficient to invoke that specific action, which varies by deployment access controls. The attack is further enabled when the regex pattern is unanchored (missing ^ and $), allowing partial prefix matches. Limiting factors include: the configuration requirement (Shell mode with regex: argument) is non-default and must be explicitly created by an administrator; and the attacker must have authenticated access to OliveTin and permission to invoke the vulnerable action. No special network position is required beyond reaching the OliveTin web interface.

The NVD CVSS 3.1 score of 6.6 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) reflects two significant mitigating factors: AC:H (a non-default Shell-mode action with a regex: argument must be configured) and PR:H (elevated OliveTin access is required). However, PR:H may overstate the privilege barrier: OliveTin is explicitly designed to give ordinary web users the ability to run predefined commands without shell accounts, so once an administrator creates a vulnerable Shell-mode action, lower-privilege OliveTin users who can invoke that action are sufficient to trigger the injection. This analyst assesses PR:L as more reflective of the exploitation scenario, with AC:H capturing the configuration prerequisite. Impact is fully High across C/I/A if exploited, because OliveTin runs commands in its own process context, granting the attacker the OS-level privileges of the OliveTin service account. No EPSS data was provided. No CISA KEV listing and no public proof-of-concept exploit have been identified at the time of analysis, which limits immediate widespread exploitation risk. Overall this is a real but constrained threat: high impact if the conditions are met, but the specific configuration requirement reduces the realistic attack surface.

An attacker with OliveTin user access finds a Shell-mode action configured with a regex: argument type - for example, curl {{ host }} with type regex:[a-zA-Z0-9.-]+. They submit the value example.com; id, which satisfies the unanchored regex match against the hostname portion while appending a shell command after the semicolon. OliveTin's wrapCommandInShell interpolates this value directly into sh -c "curl example.com; id", executing id (or any arbitrary command) in the context of the OliveTin service account. No public proof-of-concept exploit has been identified, but the attack pattern is straightforward for anyone aware of the misconfiguration.