CVE-2026-48708: OliveTin Race Condition Vulnerability

CVE-2026-48708 Overview

OliveTin is a web interface that exposes predefined shell commands for execution. CVE-2026-48708 describes a race condition [CWE-362] in the template engine of OliveTin versions 3000.0.0 and prior. The application uses a single shared text/template.Template instance, referenced as the tpl package-level variable in service/internal/tpl/templates.go, across all goroutines. Each action execution calls tpl.Parse(source) followed by t.Execute() on this shared instance without synchronization. Concurrent execution causes one goroutine's Parse to overwrite the template tree while another goroutine calls Execute. The maintainers resolved the issue in version 3000.13.0.

Critical Impact
Concurrent action execution can cause cross-user command contamination, Go runtime panics, and execution of unintended commands on the host system.

Affected Products

OliveTin versions 3000.0.0 through versions prior to 3000.13.0
Deployments exposing the OliveTin web interface to multiple concurrent users
Self-hosted OliveTin instances configured with predefined shell action templates

Discovery Timeline

2026-06-15 - CVE-2026-48708 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48708

Vulnerability Analysis

The flaw is a classic Go concurrency bug. OliveTin's template subsystem maintains one package-scoped text/template.Template value and reuses it for every action invocation. Every ExecRequest spawns its own goroutine, so multiple actions can be in flight simultaneously. Because Parse mutates the template's internal tree, calling it on the shared instance while another goroutine runs Execute corrupts the parsed template state.

The practical outcome is non-deterministic. One user's command template can be replaced by another user's source mid-execution, causing the wrong command to run. The corrupted internal state can also trigger a Go runtime panic and crash the OliveTin service.

Root Cause

The root cause is missing synchronization around a shared mutable resource. The tpl variable in service/internal/tpl/templates.go is not protected by a mutex, and no per-request template instance is created. Go's text/template package documents that Template values are safe for concurrent Execute calls only after parsing completes — concurrent Parse and Execute on the same instance is unsafe.

Attack Vector

An authenticated user with permission to trigger actions can exploit the race by issuing concurrent action requests. Because each ExecRequest runs in its own goroutine, normal multi-user activity is enough to trigger the condition. A deliberate attacker can amplify the effect by sending parallel requests to two actions with different templates, increasing the probability that one user's Execute reads a tree written by another user's Parse. The result is execution of a command the caller did not request, with the privileges of the OliveTin process.

No verified public exploit code is available for this issue. See the GitHub Security Advisory GHSA-7fq5-7wr8-rjwj for the vendor's technical description.

Detection Methods for CVE-2026-48708

Indicators of Compromise

Unexpected commands appearing in OliveTin action execution logs that do not match the requesting user's intended action.
Go runtime panic messages referencing text/template in OliveTin service logs or systemd journal output.
Sudden OliveTin process restarts or crash loops correlated with periods of concurrent user activity.

Detection Strategies

Audit OliveTin action history for mismatches between the action ID requested by a user and the command string actually executed on the host.
Inspect process accounting data (auditdexecve records) for child processes spawned by the OliveTin binary that do not correspond to any configured action template.
Monitor for stack traces containing text/template.(*Template).Execute or Parse in OliveTin crash dumps.

Monitoring Recommendations

Forward OliveTin stdout, stderr, and systemd logs to a centralized logging platform and alert on panic signatures.
Track the running OliveTin version across hosts and alert when any instance reports a version below 3000.13.0.
Correlate web access logs for /api/StartAction (or equivalent) bursts with subsequent process executions on the host.

How to Mitigate CVE-2026-48708

Immediate Actions Required

Upgrade OliveTin to version 3000.13.0 or later, available at the OliveTin 3000.13.0 release.
Restrict network access to the OliveTin web interface to trusted administrators until the upgrade is applied.
Review action execution history for any commands that may have executed under the wrong user context during the exposure window.

Patch Information

The maintainers fixed the race condition in OliveTin version 3000.13.0. The fix ensures that template parsing and execution no longer share a mutable package-level Template instance across concurrent goroutines. Operators should pull the updated container image or binary from the official release page and restart the service. Full details are in the GitHub Security Advisory GHSA-7fq5-7wr8-rjwj.

Workarounds

Limit OliveTin to a single concurrent user where feasible, reducing the probability of overlapping Parse and Execute calls.
Place OliveTin behind a reverse proxy that serializes requests to /api/StartAction until the patched version is deployed.
Disable or remove action templates that contain dynamic Go template syntax until the upgrade is complete.

bash

# Verify the installed OliveTin version and upgrade via container image
olivetin --version
docker pull ghcr.io/olivetin/olivetin:3000.13.0
docker stop olivetin && docker rm olivetin
docker run -d --name olivetin \
  -p 1337:1337 \
  -v /etc/OliveTin:/config:ro \
  ghcr.io/olivetin/olivetin:3000.13.0