CVE-2026-53541: OliveTin Authentication Bypass Vulnerability

CVE-2026-53541 Overview

OliveTin exposes predefined shell commands through a web interface. CVE-2026-53541 is an improper input validation flaw [CWE-20] in the filterToDefinedArgumentsOnly function of the OliveTin executor. Prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, arguments whose names begin with the ot_ prefix bypass the argument filter. Only two reserved system arguments (ot_executionTrackingId and ot_username) are overridden, so all other user-supplied ot_-prefixed arguments reach the executor unchecked. These values skip type validation, are written into the process environment via buildEnv(), and become available in template rendering as .Arguments.ot_*.

Critical Impact
Authenticated users can inject unvalidated environment variables and template values into executed shell actions by supplying arguments with the reserved ot_ prefix.

Affected Products

OliveTin (self-hosted web interface for predefined shell commands)
Versions prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d
Deployments exposing OliveTin actions to authenticated users

Discovery Timeline

2026-08-21 - CVE-2026-53541 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-53541

Vulnerability Analysis

OliveTin defines each action with a strict argument schema. The filterToDefinedArgumentsOnly function is intended to drop any incoming argument that is not declared in the action configuration. The function contains a carve-out that permits any argument prefixed with ot_ to pass through, on the assumption that this namespace is reserved for OliveTin-injected system values. Only ot_executionTrackingId and ot_username are overwritten server-side. Every other ot_-prefixed key supplied by the caller is retained verbatim.

Because the type-validation loop iterates only over arguments declared in the action definition, injected ot_* keys skip all type checks. The unvalidated values are then written into the child process environment through buildEnv() and exposed to Go template rendering as .Arguments.ot_*. An authenticated user who can invoke an action can therefore control environment variables and template context that the action author did not declare.

Root Cause

The root cause is an over-permissive allowlist in the argument filter. The reserved-prefix check treats client-supplied keys as trusted system arguments without confirming they originate from OliveTin itself. Combined with the type-validation loop only walking the declared schema, any ot_-prefixed key bypasses both filtering and type enforcement.

Attack Vector

Exploitation requires network access and a low-privileged authenticated session that can execute at least one action. The attacker submits an action invocation with additional parameters named ot_<arbitrary>. Those parameters are passed to the executed command as environment variables and are reachable in template expressions, enabling manipulation of action behavior beyond the intended argument surface.

text

// Patch excerpt — docs/modules/ROOT/pages/args/types.adoc
// Adds a reserved-safe identifier type; treats all ot_ system arguments as reserved.
 | ascii_identifier            | Textbox | a-Z, 0-9, `-`, `.`, `_`.
+| shell_safe_identifier       | Textbox | Like ascii identifier, also allows `@` and `+`.
 | ascii_sentence              | Textbox | a-z, 0-9, spaces, `.` and `,`.

Source: GitHub commit ebffd9f

text

// Patch excerpt — frontend/resources/vue/views/ArgumentForm.vue
-  if (arg.type === 'ascii_identifier' || arg.type === 'ascii' || arg.type === 'ascii_sentence') {
+  if (arg.type === 'ascii_identifier' || arg.type === 'shell_safe_identifier' || arg.type === 'ascii' || arg.type === 'ascii_sentence') {
     return 'text'
   }

Source: GitHub commit ebffd9f

Detection Methods for CVE-2026-53541

Indicators of Compromise

HTTP requests to OliveTin action endpoints containing form fields or JSON keys beginning with ot_ that are not ot_executionTrackingId or ot_username.
Executed action processes with environment variables prefixed OT_ (or ot_) that are not declared in the corresponding action YAML.
Action output or logs referencing .Arguments.ot_* values that were not defined by the action author.

Detection Strategies

Parse OliveTin access logs for POST bodies to the execute endpoint and flag unexpected ot_-prefixed argument names.
Compare per-action argument schemas against runtime environment variables recorded by process auditing tools such as auditd or Sysmon.
Alert on anomalous child processes spawned by the OliveTin service with unusual environment sets.

Monitoring Recommendations

Enable verbose action execution logging in OliveTin and forward logs to a central SIEM for correlation.
Monitor the OliveTin container or host for unexpected outbound connections initiated by executed actions.
Track authenticated user activity for spikes in action invocations against the same endpoint with varying ot_ argument names.

How to Mitigate CVE-2026-53541

Immediate Actions Required

Upgrade OliveTin to a build that includes commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d or later.
Restrict OliveTin access to trusted networks and authenticated administrators until the patch is applied.
Audit existing action definitions for any use of .Arguments.ot_* in templates and remove or rewrite them.

Patch Information

The fix is published in OliveTin commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d. The patch treats all ot_ system arguments as reserved, overrides them server-side, and introduces a shell_safe_identifier type to constrain values used in shell contexts. See GHSA-prj9-97mp-mwh2 for the full advisory.

Workarounds

Place OliveTin behind a reverse proxy that strips request parameters whose names start with ot_ before forwarding to the application.
Reduce the blast radius by running OliveTin under a low-privileged service account with minimal environment inheritance.
Disable or remove actions that render user-controllable template variables or rely on environment-derived values.

bash

# Example: strip ot_-prefixed query and form fields at an NGINX reverse proxy
location /api/ExecuteAction {
    if ($args ~* "(^|&)ot_[^=]+=") { return 400; }
    proxy_pass http://olivetin_backend;
    proxy_set_header X-Filtered-OT-Prefix "1";
}