OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users …

CVE-2026-28342 affects OliveTin, a web interface for predefined shell commands. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation through concurrent password hashing requests. Attackers can exploit this by sending multiple parallel requests to exhaust container memory, causing service degradation or complete denial of service. The vulnerability exists due to lack of request throttling, authentication requirements, or resource limits on computationally intensive hashing operations. The issue has been patched in version 3000.10.2.