OliveTin: Unauthenticated Remote Code Execution (CVE-2026-30225)

OliveTin versions below 3000.11.1 contain multiple vulnerabilities that facilitate unauthenticated remote code execution (RCE). The primary vectors involve insecure default configurations where guest users are granted exec permissions, combined with a lack of input validation in argument types (e.g., password, raw_string_multiline). These arguments are interpolated directly into shell templates, allowing for shell injection. Additionally, CVE-2026-30225 identifies an ACL bypass in the RestartAction function, where the application fails to maintain the authenticated context, causing actions to be re-executed with guest privileges.

Attack Chain

1. Attacker performs reconnaissance to identify exposed OliveTin API endpoints (default port 1337).
2. Attacker confirms the target is running with default guest permissions (authRequireGuestsToLogin: false).
3. Attacker maps available actions and argument structures via the API.
4. Attacker identifies an action that utilizes an unvalidated argument type in a shell: template.
5. Attacker crafts a payload to escape the shell command argument (e.g., using single quotes and command chaining).
6. Attacker sends an HTTP POST request to StartActionAndWait containing the malicious payload.
7. OliveTin processes the command as the application user (often root), executing the attacker's payload.
8. The output of the command is returned to the attacker in the response log.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary commands with the privileges of the OliveTin process. If OliveTin is running as root, this results in full system compromise.

Recommendation

1. Patch immediately: Upgrade OliveTin to version 3000.11.1 or later.
2. Harden configuration: Set authRequireGuestsToLogin: true in config.yaml and restrict exec permissions for guest and default roles.
3. Principle of Least Privilege: Ensure OliveTin runs under a dedicated, low-privilege service account rather than root.
4. Input Validation: Audit existing action definitions and remove or heavily restrict reliance on shell templates, preferring exec arguments where possible.