CVE-2026-27626 - Vulnerability Analysis

Overview

OliveTin <= 3000.10.0 contains a command injection caused by insufficient shell argument safety checks on 'password' type and webhook JSON values, letting authenticated or unauthenticated attackers execute arbitrary OS commands remotely, exploit requires webhook usage or user authentication.

Severity & Score

Impact

Attackers can execute arbitrary OS commands remotely, leading to full system compromise with OliveTin process permissions.

Mitigation

Update to the latest version once a patch is available.

References

• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-49gm-hh7w-wfvf

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 25, 2026

🔴 CVE-2026-27626 - Critical (9.9) OliveTin gives access to predefined shell commands from a web interface. In versions up to and including 3000.10.0, OliveTin's shell mode safety check (`checkShellArgumentSafety`) blocks several dangerous argument types but not `password`. A user ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27626/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner