CVE-2026-27626: Unauthenticated RCE in OliveTin Shell Mode

Critical RCE in OliveTin (CVSS 9.9). Two vectors: authenticated via password, unauthenticated via webhook.

OliveTin provides web-based access to predefined shell commands. CVE-2026-27626 is a critical vulnerability (CVSS 9.9) enabling arbitrary remote code execution. Affects versions up to 3000.10.0. Two independent attack vectors: one exploitable by authenticated users (registration enabled by default), one completely unauthenticated via webhooks.

Severity is critical. The first vector exploits the 'checkShellArgumentSafety' function which does not block 'password'-type arguments, allowing shell metacharacter injection. The second completely bypasses type checks on JSON data extracted from webhooks before passing to 'sh -c'. Social signals confirm knowledge spread; no patch available at disclosure date (February 25, 2026).

In defense: disable shell mode if not essential. Restrict access to the web UI. Validate and sanitize JSON from webhooks if sourced externally. Monitor command execution logs for anomalies. Contact the project maintainer for patched versions as soon as available.

At a glance

What: OliveTin is a web UI for executing predefined shell commands. CVE-2026-27626 comprises two RCE vectors: one via 'password'-type arguments bypassing safety checks ('checkShellArgumentSafety'), one unauthenticated via webhook with unsanitized JSON.
Severity: CVSS 9.9 (critical). Complete RCE with OliveTin process permissions. Affects versions up to 3000.10.0.
Affected versions: OliveTin versions 3000.10.0 and earlier.
Fix: No patch available at time of disclosure (February 25, 2026). Monitor official repository for updates.
Status: Vulnerability publicly disclosed. Actively circulating on social media. Patch not yet released.
Action: Disable shell mode if not essential. If webhooks from external sources: validate and sanitize JSON. Restrict access to web UI. Monitor command execution logs.

Sources: NVD, CVE-2026-27626

← All articles