CVE-2026-67437 in OliveTin
Summary
by MITRE • 07/30/2026
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapi_auth_oauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or bounding entries, allowing an unauthenticated attacker to exhaust memory and cause a denial of service. This issue is fixed in version 3000.17.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/30/2026
OliveTin represents a web-based interface that provides access to predefined shell commands through a graphical user experience, making it particularly valuable for system administrators who need to execute administrative tasks remotely. The application's architecture includes an OAuth2 authentication mechanism designed to secure access to these privileged commands. However, a critical vulnerability exists in the service's internal authentication handling that creates a significant denial of service risk. The flaw specifically resides in the OAuth2 login handler implementation within the file service/internal/auth/otoauth2/restapi_auth_oauth2.go, where the system maintains per-login state information in a global map structure called registeredStates.
The technical implementation of this vulnerability stems from a failure to properly manage memory resources during the OAuth2 authentication flow. Every time an attacker makes a request to the /oauth/login endpoint, the system creates a new entry in the registeredStates map without implementing any form of cleanup mechanism, expiration policy, or size limitation. This design flaw allows an unauthenticated attacker to continuously submit requests to the OAuth2 login endpoint, causing the registeredStates map to grow indefinitely with each new entry. The absence of garbage collection for these temporary state entries means that memory consumption increases linearly with each authentication attempt, eventually exhausting available system resources.
The operational impact of this vulnerability is severe and directly translates to a denial of service condition that affects the availability of the OliveTin service itself. An attacker can maintain sustained resource exhaustion by repeatedly initiating OAuth2 login requests, causing the application to consume all available memory and potentially leading to process termination or system instability. This vulnerability affects all versions from 3000.0.0 through 3000.16.0, representing a substantial attack surface where any unauthenticated user can exploit this weakness without requiring prior access credentials. The nature of the flaw aligns with common security patterns identified in the CWE database under CWE-400, which addresses "Uncontrolled Resource Consumption" or "Resource Exhaustion." This specific implementation vulnerability also reflects techniques documented in ATT&CK framework category T1499, which covers "Endpoint Denial of Service" and specifically targets resource consumption attacks that exhaust system capabilities.
The fix implemented in version 3000.17.0 addresses this issue through proper resource management practices that include implementing time-based expiration for state entries, establishing maximum size limits for the registeredStates map, or adding automatic cleanup mechanisms. These mitigations ensure that temporary authentication state information does not accumulate indefinitely, thereby preventing the memory exhaustion scenario that enabled the denial of service attack. Security practitioners should immediately upgrade to version 3000.17.0 or later to remediate this vulnerability and maintain the availability of OliveTin services. Organizations implementing OliveTin should also consider monitoring for unusual patterns in authentication request volumes that might indicate exploitation attempts and establish proper rate limiting measures as additional defensive controls against similar resource exhaustion scenarios in other components of their systems.