# CVE-2026-67439: OliveTin incorrect authorization in synchronous execution endpoints

Source: https://junglewise.ai/threats/cve-2026-67439-olivetin-incorrect-authorization-in-synchronous-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-67439 · Severity: medium · CVSS 4.3 · Published 2026-07-29

OliveTin, a tool for providing a web interface to shell commands, contains a security flaw where users can view the output of commands they run even if they are explicitly denied log access. This could allow an authorized user to see sensitive information, such as passwords or system details, that appear in the command's output. The issue affects specific synchronous execution features and could lead to the exposure of administrative secrets.

Technologies: [github.com/OliveTin/OliveTin (Go)](https://junglewise.ai/threats/technologies/github-com-olivetin-olivetin), [OliveTin](https://junglewise.ai/threats/technologies/olivetin). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OliveTin](https://junglewise.ai/threats/vendors/olivetin).

## Quick answers

**Is CVE-2026-67439 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67439 being exploited in the wild.

**How severe is CVE-2026-67439?** Medium severity, with a CVSS score of 4.3, published 29 July 2026.

**Which products and versions are affected?** github.com/OliveTin/OliveTin (Go) < 0.0.0-20260708085316-e421780c9885, SEMVER:introduced=0,fixed=0.0.0-20260708085316-e421780c9885; OliveTin < 0.0.0-20260708085316-e421780c9885, < 3000.17.0.

**Is there a fix for CVE-2026-67439?** Yes. github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260708085316-e421780c9885 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67439 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-67439?** Check whether you run github.com/OliveTin/OliveTin (Go) or OliveTin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/OliveTin/OliveTin (Go): upgrade to 0.0.0-20260708085316-e421780c9885 or later

  ```sh
  go get github.com/OliveTin/OliveTin@v0.0.0-20260708085316-e421780c9885
  ```


## Technical details

An authorization bypass exists in OliveTin's synchronous execution RPCs, specifically 'StartActionAndWait' and 'StartActionByGetAndWait'. While OliveTin's ACL model correctly separates 'exec' and 'logs' permissions for most endpoints, these specific handlers return a full 'LogEntry' object containing command output without verifying the 'logs' permission. An attacker with 'exec' but not 'logs' permissions can exploit this to read stdout/stderr, potentially disclosing credentials or sensitive operational data. The vulnerability was addressed in version 3000.17.0 (specifically commit e421780).

## Affected products

- OliveTin OliveTin < 0.0.0-20260708085316-e421780c9885

## Identifiers

- CVE-2026-67439
- GHSA-jm28-2wcr-qf3h
- GO-2026-6144

## Timeline

- 2026-07-08: patched: Fixed in commit e421780c9885aa5024d2f47b4ed4898f2f18eb90
- 2026-07-29: advisory: NVD publication date
- 2026-07-30: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/offset](https://api.github.com/users/offset)
- [https://github.com/offset](https://github.com/offset)
- [https://api.github.com/users/offset/gists%7B/gist_id%7D](https://api.github.com/users/offset/gists%7B/gist_id%7D)
- [https://api.github.com/users/offset/repos](https://api.github.com/users/offset/repos)
- [https://avatars.githubusercontent.com/u/114768995?v=4](https://avatars.githubusercontent.com/u/114768995?v=4)
- [https://api.github.com/users/offset/events%7B/privacy%7D](https://api.github.com/users/offset/events%7B/privacy%7D)

## Related threats

- [OliveTin input filtering bypass via ot_ prefixed arguments](https://junglewise.ai/threats/cve-2026-53541-olivetin-input-filtering-bypass-via-ot-prefixed-arguments)
- [OliveTin OS command injection in regex argument validation](https://junglewise.ai/threats/cve-2026-67438-olivetin-os-command-injection-in-regex-argument-validation)
- [OliveTin memory exhaustion via unbounded OAuth2 state map growth](https://junglewise.ai/threats/cve-2026-67437-olivetin-memory-exhaustion-via-unbounded-oauth2-state-map-growth)
- [OliveTin missing authorization in ValidateArgumentType API](https://junglewise.ai/threats/cve-2026-48709-olivetin-missing-authorization-in-validateargumenttype-api)
- [OliveTin race condition in template engine causing command contamination](https://junglewise.ai/threats/cve-2026-48708-olivetin-race-condition-in-template-engine-causing-command)