What’s Vulnerable › Vulnerabilities

CVE-2026-28790: OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-05 · updated 2026-06-17
• Weakness: CWE-284

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.

Affected products

• OliveTin: before 3000.11.0 — fixed in 3000.11.0

How to fix

Upgrade to a fixed version: OliveTin 3000.11.0. Check the vendor advisory for mitigations.

References

• https://github.com/OliveTin/OliveTin/commit/d9804182eae43cf49f735e6533ddbe1541c2b9a9
• https://github.com/OliveTin/OliveTin/releases/tag/3000.11.0
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq
• https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq

Get alerted when CVE-2026-28790 or the next vulnerability affects your stack