Is CVE-2026-67439 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67439 being exploited in the wild.

How severe is CVE-2026-67439?

Medium severity, with a CVSS score of 4.3, published 29 July 2026.

Which products and versions are affected?

github.com/OliveTin/OliveTin (Go) < 0.0.0-20260708085316-e421780c9885, SEMVER:introduced=0,fixed=0.0.0-20260708085316-e421780c9885; OliveTin < 0.0.0-20260708085316-e421780c9885, < 3000.17.0.

Is there a fix for CVE-2026-67439?

Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260708085316-e421780c9885 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67439 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-67439?

Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67439: OliveTin incorrect authorization in synchronous execution endpoints

Q: Is there a fix for CVE-2026-67439?

Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260708085316-e421780c9885 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-67439 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-67439?

Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67439 · Severity: medium · CVSS 4.3 · Published 2026-07-29

OliveTin, a tool for providing a web interface to shell commands, contains a security flaw where users can view the output of commands they run even if they are explicitly denied log access. This could allow an authorized user to see sensitive information, such as passwords or system details, that appear in the command's output. The issue affects specific synchronous execution features and could lead to the exposure of administrative secrets.

Technologies: github.com/OliveTin/OliveTin (Go), OliveTin. Vendors: Go, OliveTin.

Quick answers

Is CVE-2026-67439 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67439 being exploited in the wild.
How severe is CVE-2026-67439?: Medium severity, with a CVSS score of 4.3, published 29 July 2026.
Which products and versions are affected?: github.com/OliveTin/OliveTin (Go) < 0.0.0-20260708085316-e421780c9885, SEMVER:introduced=0,fixed=0.0.0-20260708085316-e421780c9885; OliveTin < 0.0.0-20260708085316-e421780c9885, < 3000.17.0.
Is there a fix for CVE-2026-67439?: Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260708085316-e421780c9885 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67439 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-67439?: Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260708085316-e421780c9885 or later
```
go get github.com/OliveTin/OliveTin@v0.0.0-20260708085316-e421780c9885
```

Technical details

An authorization bypass exists in OliveTin's synchronous execution RPCs, specifically 'StartActionAndWait' and 'StartActionByGetAndWait'. While OliveTin's ACL model correctly separates 'exec' and 'logs' permissions for most endpoints, these specific handlers return a full 'LogEntry' object containing command output without verifying the 'logs' permission. An attacker with 'exec' but not 'logs' permissions can exploit this to read stdout/stderr, potentially disclosing credentials or sensitive operational data. The vulnerability was addressed in version 3000.17.0 (specifically commit e421780).

Affected products

OliveTin OliveTin < 0.0.0-20260708085316-e421780c9885

Identifiers

CVE-2026-67439
GHSA-jm28-2wcr-qf3h
GO-2026-6144

Timeline

2026-07-08: patched: Fixed in commit e421780c9885aa5024d2f47b4ed4898f2f18eb90
2026-07-29: advisory: NVD publication date
2026-07-30: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.