CVE-2026-32102: high-severity vulnerability in OliveTin
OliveTin Unauthorized Action Output Disclosure via EventStream
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.5%
OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts execution events and action output to authenticated dashboard subscribers without enforcing per-action authorization. A low-privileged authenticated user can receive output from actions they are not allowed to view, resulting in broken access control and sensitive information disclosure.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
OliveTin · OliveTinRelated CVEs — OliveTin
In the same product, most dangerous first.
CVE-2026-67438MEDIUMOliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety CheckEPSS 1.6%CVE-2026-31817HIGHOliveTin's unsafe parsing of UniqueTrackingId can be used to write filesEPSS 0.8%CVE-2026-28342HIGHOliveTin: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API EndpointEPSS 0.8%CVE-2026-28790HIGHOliveTin: Unauthenticated Action Termination via KillAction When Guests Must LoginEPSS 0.7%CVE-2026-27626CRITICALOliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checksEPSS 0.6%CVE-2026-67437HIGHOliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)EPSS 0.6%