CVE-2026-48709 Overview
CVE-2026-48709 is a missing authorization vulnerability [CWE-862] in OliveTin, a web interface that gives access to predefined shell commands. The flaw resides in the ValidateArgumentType RPC endpoint within service/internal/api/api.go. Unlike other data-returning API endpoints, this handler does not invoke auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled, the endpoint remains reachable by unauthenticated network clients. Attackers can use the endpoint as an oracle to enumerate valid action binding IDs and their argument configurations. The issue affects versions 3000.0.0 and prior, and is fixed in version 3000.13.0.
Critical Impact
Unauthenticated remote attackers can enumerate action binding IDs and argument configurations on OliveTin instances configured to require guest login, exposing sensitive configuration metadata.
Affected Products
- OliveTin versions 3000.0.0 through versions prior to 3000.13.0
- Deployments with AuthRequireGuestsToLogin enabled
- Web-exposed OliveTin RPC API endpoints
Discovery Timeline
- 2026-06-15 - CVE-2026-48709 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-48709
Vulnerability Analysis
The OliveTin server exposes multiple RPC endpoints that return data about configured actions and dashboards. Most of these endpoints enforce authentication and authorization through auth.UserFromApiCall and checkDashboardAccess. The ValidateArgumentType endpoint omits both checks. An attacker can send crafted requests containing candidate action binding IDs and observe response differences to determine which IDs are valid and what argument types each accepts. This behavior turns the endpoint into an information-disclosure oracle. The exposed metadata can guide follow-up attacks against authenticated action execution paths or reveal internal automation structure.
The Exploit Prediction Scoring System (EPSS) probability is 0.269% with a percentile of 18.278, reflecting low observed exploitation interest. No public proof-of-concept code, exploit database entry, or CISA KEV listing exists for this issue at time of publication.
Root Cause
The root cause is missing authorization in the handler implementation of ValidateArgumentType in service/internal/api/api.go. The function processes requests without verifying the caller's session or permissions, breaking the security model that AuthRequireGuestsToLogin is intended to enforce. This is a classic [CWE-862] Missing Authorization defect introduced by inconsistent application of access-control middleware across RPC handlers.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker reachable to the OliveTin HTTP/RPC interface issues repeated requests to the ValidateArgumentType endpoint with varying action binding identifiers. By comparing validation responses, the attacker enumerates which identifiers correspond to real actions and infers the argument schema for each. The endpoint does not execute the actions, but the leaked metadata removes a layer of obscurity protecting downstream functionality. See the GitHub Security Advisory GHSA-f637-w7p2-m7fx for additional technical context.
Detection Methods for CVE-2026-48709
Indicators of Compromise
- Unauthenticated HTTP requests to the OliveTin RPC path invoking ValidateArgumentType from sources outside expected administrative networks
- High-volume sequential requests against the RPC endpoint indicating ID enumeration
- Access log entries showing ValidateArgumentType calls without an associated authenticated session cookie or token
Detection Strategies
- Enable verbose access logging on the OliveTin process and forward logs to a centralized logging or SIEM platform for inspection
- Create alerts for requests to ValidateArgumentType that lack an authenticated user identifier when AuthRequireGuestsToLogin is enabled
- Baseline the normal rate of RPC calls and alert on statistical deviations consistent with enumeration
Monitoring Recommendations
- Monitor the OliveTin reverse proxy or ingress logs for repeated POST requests to RPC handlers from a single source IP
- Track the deployed OliveTin version across hosts and flag any instance below 3000.13.0
- Review network egress and ingress allowlists for the OliveTin management interface to ensure exposure is restricted to trusted ranges
How to Mitigate CVE-2026-48709
Immediate Actions Required
- Upgrade OliveTin to version 3000.13.0 or later, which adds the missing authentication and authorization checks to ValidateArgumentType
- Restrict network access to the OliveTin web interface using firewall rules, VPN, or reverse-proxy authentication until the upgrade is complete
- Audit existing access logs for unauthenticated calls to ValidateArgumentType to identify prior enumeration attempts
Patch Information
The maintainers fixed the issue in OliveTin release 3000.13.0. The patch adds authorization checks consistent with other data-returning RPC handlers. Administrators should follow the project's standard upgrade procedure for their deployment method (container image, binary, or package).
Workarounds
- Place OliveTin behind a reverse proxy that enforces authentication for all RPC paths until the upgrade is applied
- Limit access to the OliveTin listener to trusted source IP ranges through host or network firewall rules
- Disable public exposure of the OliveTin endpoint and require VPN connectivity for administrative users
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
