CVE-2026-48708: OliveTin has a Concurrent Template Parsing Race Condition which Leads to Cross-Request Command Contamination

Synopsis

A concurrent template-parsing race condition in OliveTin (versions up to and including 3000.0.0) allows one authenticated user's goroutine to overwrite a shared template while another goroutine is executing it. The attack is reachable over the network, requires a low-privilege account, and needs no victim interaction. Successful exploitation causes cross-user command contamination (one user's shell command is injected into another user's execution context), Go runtime panics, and incorrect command execution. No patched image rebuild is currently available on HarborGuard, as no upstream fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable OliveTin web interface must be reachable over the network; the attacker sends concurrent action-execution requests to trigger the race condition remotely.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker needs only the level of access required to trigger action executions through the OliveTin web interface.

• Victim interactionNot required

  No victim interaction is needed; the race condition is triggered purely by the attacker sending concurrent requests without any user having to click or approve anything.

• Attack complexityDetail

  Attack complexity is high because the exploit depends on a timing race between concurrent goroutines, requiring the attacker to reliably overlap a Parse call from one goroutine with an Execute call from another.

Blast Radius

• One user's shell command is substituted into another user's execution context, causing unintended commands to run under the wrong user's session.
• The Go runtime panics when the shared template tree is corrupted mid-execution, crashing the OliveTin service and denying access to all users.
• An attacker can read the templated command output intended for another user, exposing sensitive data carried in those command results.
• An attacker can cause arbitrary predefined shell commands to execute out of order or with wrong parameters, modifying system state beyond what the attacker's own permissions would normally allow.