CVE-2026-28789: 
NixOS vulnerability analysis and mitigation

CVE-2026-28789 is an unauthenticated denial-of-service vulnerability in OliveTin's OAuth2 login flow, caused by unsynchronized concurrent access to a shared Go map. Concurrent HTTP requests to the /oauth/login endpoint trigger concurrent writes to the registeredStates map without mutex protection, causing a Go runtime panic (fatal error: concurrent map writes) and process termination. All OliveTin versions up to and including 3000.10.2 are affected when OAuth2 is enabled; the issue was patched in version 3000.10.3. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause is a race condition (CWE-362 / CWE-662) in service/internal/auth/otoauth2/restapi_auth_oauth2.go, where the registeredStates map is accessed by multiple goroutines without synchronization. Specifically, unlocked writes occur at line 141 (login handler), unlocked reads at line 174 (callback check), unlocked writes at lines 284–285 (callback flow), and an unlocked read at line 376 (auth chain check). Because Go's HTTP server dispatches each request in its own goroutine, high-concurrency traffic to the publicly registered /oauth/login route causes simultaneous map writes, which Go's runtime detects and responds to by panicking and terminating the process. The fix introduced a sync.RWMutex (mu) on the OAuth2Handler struct, wrapping all map accesses with appropriate Lock/RLock calls (GitHub Advisory, Patch Commit).

Successful exploitation results in complete availability loss of the OliveTin service — the Go process terminates with a fatal runtime panic, taking down the web interface and all predefined shell command access until the service is manually restarted. There is no confidentiality or integrity impact, as the attack only causes process termination. Because OliveTin provides access to predefined shell commands, repeated crashes could disrupt automated operations or administrative workflows that depend on the service (GitHub Advisory).

A proof-of-concept Python script (poc_oauth2_state_map_race_dos.py) is publicly documented in the GitHub security advisory, with specific parameters (80 workers, 120,000 requests) confirmed to reliably crash the service. No authentication is required; the only precondition is that OAuth2 must be enabled on the target instance and the /oauth/login endpoint must be network-reachable. The EPSS score is approximately 0.089%, and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory).

1. Reconnaissance: Identify OliveTin instances with OAuth2 enabled and the /oauth/login endpoint reachable over the network. Confirm the service is running by sending curl -i http://<target>:1337/readyz (expected: HTTP 200) and curl -i "http://<target>:1337/oauth/login?provider=github" (expected: HTTP 302 redirect).
2. Prepare PoC tool: Obtain or recreate the poc_oauth2_state_map_race_dos.py script referenced in the advisory, which sends high-concurrency requests to the /oauth/login endpoint.
3. Launch concurrent flood: Execute the PoC with high parallelism to trigger simultaneous map writes:

   python3 poc_oauth2_state_map_race_dos.py --base-url http://<target>:1337 --provider github --workers 80 --requests 120000 --health-failures 3

4. Trigger Go runtime panic: The concurrent goroutines simultaneously write to the unsynchronized registeredStates map, causing Go's runtime to detect concurrent map writes and terminate the process with fatal error: concurrent map writes.
5. Verify crash: Confirm the service is down via curl -i http://<target>:1337/readyz (connection refused) or inspect container/process logs for the fatal error: concurrent map writes message and a non-zero exit code (GitHub Advisory).

• Logs: OliveTin process logs containing fatal error: concurrent map writes and stack traces referencing restapi_auth_oauth2.go:141 (HandleOAuthLogin); Go runtime goroutine dump output in stderr/container logs.
• Network: High volume of concurrent HTTP GET/POST requests to /oauth/login from one or more source IPs in a short time window; requests may include a provider query parameter (e.g., ?provider=github).
• Process: Unexpected OliveTin process termination with exit code 2; repeated service restarts in a short period (if configured with auto-restart); absence of graceful shutdown log messages.
• System: Container or process supervisor logs showing OliveTin exiting abnormally; monitoring alerts for service unavailability on the OliveTin port (GitHub Advisory).

Upgrade OliveTin to version 3000.10.3 or later, which introduces a sync.RWMutex to properly synchronize all accesses to the registeredStates map. If immediate upgrade is not possible, disable OAuth2 authentication in the OliveTin configuration, or restrict network access to the /oauth/login and /oauth/callback endpoints using a firewall, WAF, or reverse proxy to limit exposure to trusted sources only (GitHub Advisory, Patch Commit).

The vulnerability was responsibly disclosed by researcher kule500 and acknowledged by OliveTin maintainer jamesread in the patch commit message. The advisory was published on GitHub on March 1, 2026, and the CVE was assigned shortly after. Coverage appeared on CVE aggregator sites and Mastodon security feeds, but no significant mainstream media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory, Patch Commit).