# CVE-2026-28789

## Summary

- **CVE ID:** CVE-2026-28789
- **Severity:** HIGH
- **CVSS Score:** 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- **CWE:** CWE-362, CWE-662, CWE-400
- **Published:** Mar 5, 2026
- **Last Modified:** Mar 12, 2026

## Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.3, an unauthenticated denial-of-service vulnerability exists in OliveTin’s OAuth2 login flow. Concurrent requests to /oauth/login can trigger unsynchronized access to a shared registeredStates map, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. This allows remote attackers to crash the service when OAuth2 is enabled. This issue has been patched in version 3000.10.3.

## Affected Products

- OliveTin — OliveTin (< 3000.10.3)

## References

- [CNA](https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45m3-398w-m2m9)
- [CNA](https://github.com/OliveTin/OliveTin/commit/f044d90d5525c4c8e3f421b32ed7eff771c22d36)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.39%
- **EPSS Percentile:** 32.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-09._