# CVE-2026-48709: OliveTin missing authorization in ValidateArgumentType API

Source: https://junglewise.ai/threats/cve-2026-48709-olivetin-missing-authorization-in-validateargumenttype-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-48709 · Severity: low · CVSS 3.7 · Published 2026-06-15

OliveTin is a tool that provides a simple web interface for running shell commands. A security flaw was found where unauthenticated users can discover what actions and parameters are configured on the server, even when the system is set to require a login. While this does not allow attackers to run commands directly, it exposes sensitive information about the server's configuration and helps them plan more advanced attacks.

Technologies: [github.com/OliveTin/OliveTin (Go)](https://junglewise.ai/threats/technologies/github-com-olivetin-olivetin), [OliveTin](https://junglewise.ai/threats/technologies/olivetin). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OliveTin](https://junglewise.ai/threats/vendors/olivetin).

## Quick answers

**Is CVE-2026-48709 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48709 being exploited in the wild.

**How severe is CVE-2026-48709?** Low severity, with a CVSS score of 3.7, published 15 June 2026.

**Which products and versions are affected?** github.com/OliveTin/OliveTin (Go) < 0.0.0-20260521230847-a3865704c854, SEMVER:introduced=0,fixed=0.0.0-20260521230847-a3865704c854; OliveTin < 3000.13.0, <= 3000.11.3.

**Is there a fix for CVE-2026-48709?** Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521230847-a3865704c854 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48709 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-48709?** Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260521230847-a3865704c854 or later

  ```sh
  go get github.com/OliveTin/OliveTin@v0.0.0-20260521230847-a3865704c854
  ```


## Technical details

The `ValidateArgumentType` RPC endpoint in `service/internal/api/api.go` fails to implement authentication or authorization checks, specifically missing calls to `auth.UserFromApiCall` or `checkDashboardAccess`. When `AuthRequireGuestsToLogin` is enabled, this endpoint remains reachable to unauthenticated network actors. Because binding IDs are predictable SHA256 hashes of action titles and the endpoint returns different responses for valid vs. invalid arguments, it functions as an oracle. Attackers can use this to enumerate the server's internal action configuration and argument types. This vulnerability was patched in version 3000.13.0.

## Affected products

- OliveTin OliveTin < 3000.13.0

## Identifiers

- CVE-2026-48709
- GHSA-f637-w7p2-m7fx
- GO-2026-5347

## Timeline

- 2026-05-21: disclosed
- 2026-05-21: patched: Fixed in commit a386570 and release 3000.13.0
- 2026-06-24: advisory

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [OliveTin input filtering bypass via ot_ prefixed arguments](https://junglewise.ai/threats/cve-2026-53541-olivetin-input-filtering-bypass-via-ot-prefixed-arguments)
- [OliveTin incorrect authorization in synchronous execution endpoints](https://junglewise.ai/threats/cve-2026-67439-olivetin-incorrect-authorization-in-synchronous-execution)
- [OliveTin OS command injection in regex argument validation](https://junglewise.ai/threats/cve-2026-67438-olivetin-os-command-injection-in-regex-argument-validation)
- [OliveTin memory exhaustion via unbounded OAuth2 state map growth](https://junglewise.ai/threats/cve-2026-67437-olivetin-memory-exhaustion-via-unbounded-oauth2-state-map-growth)
- [OliveTin race condition in template engine causing command contamination](https://junglewise.ai/threats/cve-2026-48708-olivetin-race-condition-in-template-engine-causing-command)