CVE-2026-48708: OliveTin Race Condition Causes Command Contamination in Multi-User Environments

Technical summary

CVE-2026-48708 exploits unsynchronized access to a shared Go text/template.Template instance in OliveTin's template processing pipeline. The service/internal/tpl/templates.go module maintains a package-level tpl variable that all goroutines reference. Each ExecRequest spawns a goroutine that calls tpl.Parse(source) followed by t.Execute() without mutex protection or atomic swaps. When two or more actions execute concurrently, one goroutine's Parse call overwrites the template abstract syntax tree while another goroutine is mid-Execute, causing the executing goroutine to read corrupted or partially-overwritten template state. This results in CWE-362 (concurrent use without synchronization) and CWE-567 (unsynchronized access to shared data), manifesting as command confusion, panics, or data leakage between execution contexts.

Business impact

Organizations using OliveTin for infrastructure automation, DevOps orchestration, or operational runbooks face three critical risks: (1) Integrity: commands may execute with parameters intended for other users or contexts, potentially modifying wrong systems or triggering unintended infrastructure changes; (2) Availability: concurrent execution attempts can crash the application, interrupting operational workflows; (3) Confidentiality: command outputs or intermediate states from one user's action may be visible to another, potentially exposing secrets or sensitive operational data. In multi-user or high-concurrency environments, exploitation is trivial to trigger—it occurs under normal load.

Affected systems

OliveTin versions 3000.0.0 and earlier are vulnerable. Version 3000.13.0 and later contain the fix. Any deployment running concurrent action executions is at risk; the vulnerability does not require special network conditions or authentication bypass, only authenticated access and parallel request timing.

Exploitability

Exploitability is moderate-to-high under real-world conditions. The race condition requires concurrent execution, which is the default operational mode when multiple users or scheduled jobs interact with OliveTin simultaneously. An attacker with valid credentials can reliably trigger the condition by issuing multiple action requests in quick succession. The CVSS score of 7.5 reflects this: network-accessible, requires login (PR:L), but no user interaction, high impact on confidentiality, integrity, and availability. No known public exploit code exists, but the vulnerability is logic-level and does not require a zero-day technique—standard concurrent testing can reproduce it.

Remediation

Upgrade OliveTin to version 3000.13.0 or later. Verify the version in your deployment (typically visible in the web UI or via version API endpoint). After upgrading, restart the service and confirm that concurrent action executions no longer cause crashes or command confusion. No configuration changes or data migration is required; the fix is code-level synchronization.

Patch guidance

1. Review your current OliveTin version (check web UI or logs for the running version number). 2. Back up your OliveTin configuration directory (typically ~/.config/OliveTin or /etc/OliveTin) to preserve action definitions and settings. 3. Download version 3000.13.0 or the latest available version from the OliveTin project repository. 4. Stop the running OliveTin service. 5. Replace the binary or container image with the patched version. 6. Restart the service and verify it starts without errors. 7. Run a quick sanity test: execute a known action and confirm it completes with expected output. 8. If using OliveTin in a container, ensure your image is rebuilt or pulled from a source that has been updated to include the patched version.

Detection guidance

Monitor OliveTin logs and application performance metrics for these indicators: (1) Unexpected Go runtime panic messages in logs (often containing 'concurrent map' or 'template' references); (2) Mismatches between requested command parameters and executed behavior (log the action request and compare against actual command invoked); (3) Sudden spikes in request errors or HTTP 500 responses during periods of high concurrency; (4) Users reporting that their action outputs contain results from other users' actions. Implement request-level logging to capture action name, requester, parameters, and execution timestamp. Correlate logs with timestamps to identify overlapping executions that preceded errors.

Why prioritize this

This vulnerability merits immediate attention despite not being on the CISA KEV list. It combines authenticated access (reducing external attack surface) with trivial reproducibility under normal load (high internal risk). Organizations with multi-user OliveTin deployments or those relying on concurrent automation should prioritize patching within 1–2 weeks. Single-operator deployments or those with serialized action execution can defer slightly longer but should still patch within a month. The fix is low-risk (code-level synchronization with no breaking changes), making delay unjustifiable.

Risk score, explained

CVSS 7.5 (HIGH) is appropriate: Network-accessible (AV:N), requires login (PR:L), race conditions are timing-dependent so not every attempt triggers (AC:H), but impact is severe—all three of C, I, A are High. The absence from the CISA KEV list reflects lack of observed in-the-wild exploitation, not lack of severity. Real-world impact depends heavily on deployment context: security-critical automation or sensitive multi-tenant setups push this toward critical; isolated single-operator labs lower practical risk.

Frequently asked questions