CVE-2026-67437: OliveTin OAuth2 DoS Vulnerability

CVE-2026-67437 Overview

CVE-2026-67437 is a denial-of-service vulnerability in OliveTin, an application that exposes predefined shell commands through a web interface. The flaw resides in the OAuth2 login handler at service/internal/auth/otoauth2/restapi_auth_oauth2.go. Each request to /oauth/login inserts a new entry into the in-memory registeredStates map. Entries never expire, are never deleted after use, and the map has no upper bound. An unauthenticated remote attacker can issue repeated login requests to exhaust process memory and crash the service. Versions from 3000.0.0 up to 3000.17.0 are affected. The issue is fixed in release 3000.17.0.

Critical Impact
An unauthenticated network attacker can trigger unbounded memory allocation in the OliveTin OAuth2 login flow, leading to service crash and denial of shell-command automation for legitimate users.

Affected Products

OliveTin versions 3000.0.0 through 3000.16.x
OAuth2 login handler in service/internal/auth/otoauth2/restapi_auth_oauth2.go
Deployments exposing /oauth/login to untrusted networks

Discovery Timeline

2026-07-29 - CVE-2026-67437 published to the National Vulnerability Database
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67437

Vulnerability Analysis

OliveTin uses OAuth2 for authentication and tracks the per-login state parameter server-side. The /oauth/login handler generates a state value and stores it in a package-level registeredStates map keyed by the state string. This map is intended to correlate the eventual OAuth2 callback with the original login attempt.

The handler writes to registeredStates on every request without validating rate, capping the map size, or aging entries out. Successful callbacks do not consistently remove state entries, and abandoned login flows leave records in memory indefinitely. The behavior maps to [CWE-400: Uncontrolled Resource Consumption].

Because the endpoint requires no authentication and no user interaction, an attacker can script sustained requests to /oauth/login. Each request adds a new heap allocation for the state entry. Given a small OliveTin container footprint, exhaustion is reachable within a short interval, causing the Go runtime to terminate the process or the orchestrator to kill it under memory pressure.

Root Cause

The registeredStates map lacks a maximum entry count, a time-to-live for entries, and cleanup on failed or abandoned OAuth2 handshakes. State tracking treats every incoming request as legitimate and durable.

Attack Vector

The attacker sends repeated unauthenticated HTTP GET requests to the /oauth/login endpoint. No credentials, tokens, or user interaction are required. The impact is availability loss only; confidentiality and integrity are not affected.

// Patch excerpt from service/internal/auth/otoauth2/restapi_auth_oauth2.go
// Adds creation timestamp and bounds for state map entries
	providerName   string
	Username       string
	Usergroup      string
+	createdAt      time.Time
}

+const (
+	oauthStateMaxAge     = 900 // matches olivetin-sid-oauth cookie MaxAge
+	oauthStateMaxEntries = 10000
+)
+
func assignIfEmpty(target *string, value string) {
	if *target == "" {
		*target = value

Source: GitHub Commit ec114e9. The patch introduces a createdAt timestamp on each state entry, caps the map at 10000 entries, and enforces a 900-second maximum age aligned with the olivetin-sid-oauth cookie lifetime.

Detection Methods for CVE-2026-67437

Indicators of Compromise

High-volume unauthenticated GET requests to /oauth/login from a single source or distributed set of sources.
OliveTin process resident memory (RSS) climbing without corresponding successful OAuth2 callbacks to /oauth/callback.
OliveTin container restarts triggered by out-of-memory (OOM) events in Kubernetes or systemd logs.

Detection Strategies

Instrument the reverse proxy or ingress fronting OliveTin to log request rates per client IP against /oauth/login.
Alert on a widening ratio between /oauth/login requests and completed /oauth/callback requests over rolling windows.
Monitor Go runtime metrics (go_memstats_heap_inuse_bytes) for sustained growth on OliveTin instances.

Monitoring Recommendations

Forward web server access logs and container OOM events to a central log platform for correlation.
Track OliveTin release version across hosts and flag any instance below 3000.17.0.
Enable rate-limit metrics on the fronting proxy and alert when thresholds trip against the OAuth2 endpoints.

How to Mitigate CVE-2026-67437

Immediate Actions Required

Upgrade OliveTin to version 3000.17.0 or later, which bounds and expires state map entries.
Restrict network exposure of /oauth/login to trusted networks or authenticated reverse proxies until patched.
Apply rate limiting at the ingress layer to cap unauthenticated requests to OAuth2 endpoints.

Patch Information

The fix is delivered in OliveTin release 3000.17.0 via commit ec114e9. Full advisory details are available in GHSA-xpxj-f2fm-rqch.

Workarounds

Place OliveTin behind a reverse proxy that enforces per-IP rate limits on /oauth/login.
Require network-level authentication (VPN, mTLS, or IP allowlists) in front of the OliveTin web interface.
Set container memory limits with automatic restart policies to contain impact until the upgrade is applied.

bash

# Example nginx rate limit for the OliveTin OAuth2 login endpoint
http {
    limit_req_zone $binary_remote_addr zone=olivetin_oauth:10m rate=5r/m;

    server {
        location /oauth/login {
            limit_req zone=olivetin_oauth burst=5 nodelay;
            proxy_pass http://olivetin_backend;
        }
    }
}