Detections
Analytics

SCA: security update for github.com/OliveTin/OliveTin (GHSA-49gm-hh7w-wfvf)

critical Tenable Self-Hosted Container Security Plugin ID 438087

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - OliveTin gives access to predefined shell commands from a web interface. In versions up to and including
 3000.10.0, OliveTin's shell mode safety check (`checkShellArgumentSafety`) blocks several dangerous
 argument types but not `password`. A user supplying a `password`-typed argument can inject shell
 metacharacters that execute arbitrary OS commands. A second independent vector allows unauthenticated RCE
 via webhook-extracted JSON values that skip type safety checks entirely before reaching `sh -c`. When
 exploiting vector 1, any authenticated user (registration enabled by default, `authType: none` by default)
 can execute arbitrary OS commands on the OliveTin host with the permissions of the OliveTin process. When
 exploiting vector 2, an unauthenticated attacker can achieve the same if the instance receives webhooks
 from external sources, which is a primary OliveTin use case. When an attacker exploits both vectors, this
 results in unauthenticated RCE on any OliveTin instance using Shell mode with webhook-triggered actions.
 As of time of publication, a patched version is not available. (CVE-2026-27626)

See Also

https://github.com/advisories/GHSA-49gm-hh7w-wfvf

Plugin Details

Severity: Critical

ID: 438087

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 3/3/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 94.39

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-27626

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2/25/2026

Vulnerability Publication Date: 2/25/2026

Reference Information

CVE: CVE-2026-27626

cwe: CWE-78