CVE-2026-67437

High

Description

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowing an unauthenticated attacker to exhaust memory and cause a denial of service. This issue is fixed in version 3000.17.0.

SeverityHigh

CVSS7.5

Exploit probability—

ProductGithub.com/olivetin/olivetin

PublishedJul 29, 2026

First seenJul 29, 2026

Weakness typeCWE-400Uncontrolled resource consumption CWE-401CWE-401 CWE-770Allocation of resources without limits

How to fix

Update

github.com/OliveTin/OliveTin0.0.0-20260708075951-ec114e95d297 or later

Affected products

Product	Affected versions	Fixed in
github.com/OliveTin/OliveTinGo	0.0.0-20251024001301-45f9c18bc3ee ≤ v < 0.0.0-20260708075951-ec114e95d297	0.0.0-20260708075951-ec114e95d297

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.