CVE-2026-28789 Details
Description
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.
A denial-of-service vulnerability has been identified in OliveTin versions prior to 3000.10.3, within the OAuth2 login process. This issue allows remote attackers to crash the service by sending concurrent requests to the OAuth2 login endpoint. The vulnerability arises from unsynchronized access to a shared map that stores login states, leading to a Go runtime panic and process termination. This problem can be exploited when OAuth2 is enabled and the service is accessible over the network.
Users can upgrade to OliveTin version 3000.10.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45m3-398w-m2m9 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/OliveTin/OliveTin/commit/f044d90d5525c4c8e3f421b32ed7eff771c22d36 | [email protected] | Patch |
| https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45m3-398w-m2m9 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-662 | Improper Synchronization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| olivetin olivetin | <= 3000.10.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 10, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | CVE Modified | CISA-ADP |
| Mar 5, 2026 | New CVE Received | [email protected] |