CVE-2026-67438: OliveTin RCE Vulnerability

CVE-2026-67438 Overview

OliveTin exposes predefined shell commands through a web interface for administrative convenience. A flaw in the checkShellArgumentSafety function within service/internal/executor/arguments.go fails to treat regex: custom argument types as unsafe for Shell mode actions. Attackers with authenticated access can supply values that pass typeSafetyCheckRegex and are interpolated by wrapCommandInShell into an sh -c command string, enabling OS command injection [CWE-78]. The issue affects OliveTin from version 3000.2.0 through 3000.16.x and is fixed in 3000.17.0.

Critical Impact
Authenticated attackers can inject arbitrary operating system commands into shell-mode actions, executing them with the privileges of the OliveTin service account.

Affected Products

OliveTin versions 3000.2.0 through 3000.16.x
Deployments using Shell mode actions with regex: custom argument types
Self-hosted OliveTin web interfaces exposed to authenticated users

Discovery Timeline

2026-07-29 - CVE-2026-67438 published to NVD
2026-07-29 - Last updated in NVD database
3000.17.0 - OliveTin releases patched version

Technical Details for CVE-2026-67438

Vulnerability Analysis

OliveTin allows administrators to define actions that map web-interface buttons to shell commands. Each action accepts typed arguments, and the typeSafetyCheckRegex function validates argument values against either predefined patterns or user-defined regex: patterns. The checkShellArgumentSafety function is responsible for blocking dangerous characters before values reach wrapCommandInShell, which builds an sh -c string.

The function did not classify regex: custom argument types as unsafe for Shell mode. Any value passing the custom regex was interpolated directly into the shell command string. Because operators frequently write permissive patterns, shell metacharacters such as ;, |, &&, and backticks could slip through and reach the shell interpreter.

Root Cause

The root cause is a missing safety classification combined with unanchored regex evaluation. The original typeSafetyCheckRegex accepted the user pattern verbatim, so a pattern like .* or [a-zA-Z0-9 ]+ could match a substring of a malicious payload rather than validating the whole value. Combined with shell interpolation, this permits command injection through argument boundaries.

Attack Vector

An attacker with permission to invoke a Shell mode action that uses a regex: argument submits a crafted value containing shell metacharacters. The value passes the permissive custom regex, is embedded in the sh -c string, and the injected commands execute with the OliveTin process privileges.

// Security patch applied in service/internal/executor/arguments.go
func anchorCustomRegexPattern(pattern string) string {
	if strings.HasPrefix(pattern, "^") && strings.HasSuffix(pattern, "$") {
		return pattern
	}

	return "^(?:" + pattern + ")$"
}

func typeSafetyCheckRegex(name string, value string, argumentType string) error {
	pattern := ""
	isCustomRegex := strings.HasPrefix(argumentType, "regex:")

	if isCustomRegex {
		pattern = strings.TrimPrefix(argumentType, "regex:")
		pattern = anchorCustomRegexPattern(pattern)
	} else {
		found := false
		pattern, found = typecheckRegex[argumentType]
	}
	// ...
}

Source: GitHub Commit 995ff79. The patch anchors user-supplied regex patterns with ^(?:...)$ so they must match the entire value, closing the substring-match bypass.

Detection Methods for CVE-2026-67438

Indicators of Compromise

Unexpected child processes spawned by the OliveTin service, particularly sh, bash, curl, wget, or nc invocations not tied to configured actions
OliveTin action logs showing argument values containing shell metacharacters such as ;, |, &, $(, or backticks
Outbound network connections from the OliveTin host to previously unseen destinations following action executions

Detection Strategies

Audit config.yaml for actions defined with shell mode that also declare arguments of type regex:..., and review the regex patterns for permissiveness
Correlate OliveTin action-invocation logs with process-creation telemetry to identify unexpected command lineage from the OliveTin binary
Alert on any OliveTin child process that executes a shell interpreter with an argument string containing metacharacter sequences

Monitoring Recommendations

Enable verbose action logging within OliveTin and forward logs to a central SIEM for retention and search
Monitor authentication events on the OliveTin web interface for account takeover attempts targeting privileged users
Track filesystem writes and network connections initiated by the OliveTin service process for post-exploitation activity

How to Mitigate CVE-2026-67438

Immediate Actions Required

Upgrade OliveTin to version 3000.17.0 or later on all deployments
Inventory every Shell mode action that uses regex: argument types and validate that patterns are strict and anchored
Restrict web-interface access to trusted operators and enforce strong authentication

Patch Information

The fix landed in OliveTin 3000.17.0. See the GitHub Release 3000.17.0 notes, the GitHub Security Advisory GHSA-xc5w-4v5w-7x65, and the patch commit 995ff79. The patch anchors user-defined regex patterns so they must match the full argument value.

Workarounds

Convert Shell mode actions to exec mode where possible, which passes arguments as an array and avoids shell interpolation
Rewrite regex: argument patterns to include explicit ^ and $ anchors and exclude shell metacharacters from the allowed character class
Remove or disable Shell mode actions that depend on regex: argument validation until the upgrade is completed

bash

# Upgrade OliveTin to the patched release
docker pull olivetin/olivetin:3000.17.0
docker stop olivetin && docker rm olivetin
docker run -d --name olivetin \
  -p 1337:1337 \
  -v /etc/OliveTin/config.yaml:/config/config.yaml:ro \
  olivetin/olivetin:3000.17.0

# Verify the running version
curl -s http://localhost:1337/api/GetDashboardComponents | grep -i version