Is CVE-2026-48709 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48709 being exploited in the wild.

How severe is CVE-2026-48709?

Low severity, with a CVSS score of 3.7, published 15 June 2026.

Which products and versions are affected?

github.com/OliveTin/OliveTin (Go) < 0.0.0-20260521230847-a3865704c854, SEMVER:introduced=0,fixed=0.0.0-20260521230847-a3865704c854; OliveTin < 3000.13.0, <= 3000.11.3.

Is there a fix for CVE-2026-48709?

Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521230847-a3865704c854 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-48709 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48709?

Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48709: OliveTin missing authorization in ValidateArgumentType API

Q: Is there a fix for CVE-2026-48709?

Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521230847-a3865704c854 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-48709 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-48709?

Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48709 · Severity: low · CVSS 3.7 · Published 2026-06-15

OliveTin is a tool that provides a simple web interface for running shell commands. A security flaw was found where unauthenticated users can discover what actions and parameters are configured on the server, even when the system is set to require a login. While this does not allow attackers to run commands directly, it exposes sensitive information about the server's configuration and helps them plan more advanced attacks.

Technologies: github.com/OliveTin/OliveTin (Go), OliveTin. Vendors: Go, OliveTin.

Quick answers

Is CVE-2026-48709 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48709 being exploited in the wild.
How severe is CVE-2026-48709?: Low severity, with a CVSS score of 3.7, published 15 June 2026.
Which products and versions are affected?: github.com/OliveTin/OliveTin (Go) < 0.0.0-20260521230847-a3865704c854, SEMVER:introduced=0,fixed=0.0.0-20260521230847-a3865704c854; OliveTin < 3000.13.0, <= 3000.11.3.
Is there a fix for CVE-2026-48709?: Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521230847-a3865704c854 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48709 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48709?: Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521230847-a3865704c854 or later
```
go get github.com/OliveTin/OliveTin@v0.0.0-20260521230847-a3865704c854
```

Technical details

The `ValidateArgumentType` RPC endpoint in `service/internal/api/api.go` fails to implement authentication or authorization checks, specifically missing calls to `auth.UserFromApiCall` or `checkDashboardAccess`. When `AuthRequireGuestsToLogin` is enabled, this endpoint remains reachable to unauthenticated network actors. Because binding IDs are predictable SHA256 hashes of action titles and the endpoint returns different responses for valid vs. invalid arguments, it functions as an oracle. Attackers can use this to enumerate the server's internal action configuration and argument types. This vulnerability was patched in version 3000.13.0.

Affected products

OliveTin OliveTin < 3000.13.0

Identifiers

CVE-2026-48709
GHSA-f637-w7p2-m7fx
GO-2026-5347

Timeline

2026-05-21: disclosed
2026-05-21: patched: Fixed in commit a386570 and release 3000.13.0
2026-06-24: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.