CVE-2026-28790: 
NixOS vulnerability analysis and mitigation

CVE-2026-28790 is a broken access control vulnerability in OliveTin, a web interface for executing predefined shell commands, that allows unauthenticated guests to terminate running actions via the KillAction RPC endpoint even when authRequireGuestsToLogin: true is configured. The vulnerability affects all OliveTin versions prior to 3000.11.0 (confirmed tested on 3000.10.2) and was disclosed via a GitHub Security Advisory on March 2, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is inconsistent authorization enforcement across RPC endpoints, classified as CWE-284 (Improper Access Control), CWE-862 (Missing Authorization), and CWE-863 (Incorrect Authorization). When authRequireGuestsToLogin is enabled, the config sanitization in service/internal/config/sanitize.go correctly sets DefaultPermissions.View, Exec, and Logs to false, but omits DefaultPermissions.Kill, leaving it at its default allowed state. The KillAction() handler in service/internal/api/api.go applies only a per-action kill ACL check (IsAllowedKill()) and does not enforce the guest login gate present at line 474 of the same file, meaning an unauthenticated guest can satisfy the ACL check and successfully invoke KillAction directly via HTTP POST to /api/KillAction with a known executionTrackingId. The fix, committed in d9804182, adds a single line setting DefaultPermissions.Kill = false in the sanitization function (GitHub Advisory, GitHub Commit).

Successful exploitation results in a denial-of-service condition against legitimate action executions — an unauthenticated attacker can terminate any running action for which they know or can guess the executionTrackingId. This can disrupt long-running administrative or operational workflows such as maintenance tasks, deployments, backups, or service-control operations initiated by authenticated users. There is no confidentiality or integrity impact; the vulnerability is limited to availability of OliveTin-managed action executions (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the full attack chain using standard curl commands against a default OliveTin 3000.10.2 deployment. The vulnerability requires no authentication, no user interaction, and only network access to the OliveTin HTTP frontend, making it trivially exploitable. There is no evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is 0.058% (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible OliveTin instances running versions prior to 3000.11.0 using tools like Shodan or Censys, or by probing the /readyz endpoint.
2. Confirm guest restriction: Send a POST request to /api/GetDashboard without credentials to confirm the instance has authRequireGuestsToLogin: true enabled (expected response: HTTP 403 Forbidden with "guests are not allowed to access the dashboard").
3. Obtain an executionTrackingId: Acquire a valid executionTrackingId for a running action — this may be obtained through insider knowledge, shared operator channels, predictable ID patterns, or adjacent information leaks.
4. Invoke KillAction unauthenticated: Send an unauthenticated HTTP POST to /api/KillAction with the payload {"executionTrackingId": "<target-id>"} and Content-Type: application/json.
5. Confirm termination: A successful response of HTTP 200 OK with {"killed": true, "found": true} confirms the running action has been terminated (GitHub Advisory).

• Network: Unexpected HTTP POST requests to /api/KillAction originating from unauthenticated or unknown source IPs; requests lacking session cookies or authentication headers targeting the OliveTin frontend port.
• Logs: OliveTin log entries showing Authenticated API request ... path="/olivetin.api.v1.OliveTinApiService/KillAction" ... username="guest" followed by Killing execution request by tracking ID: <id> and Action finished ... exit="-1" for actions that should not have been stopped.
• Application Behavior: Running actions terminating unexpectedly with exit code -1 without corresponding admin activity; actions started by authenticated users being killed without a matching authenticated kill request (GitHub Advisory).

Upgrade OliveTin to version 3000.11.0 or later, which includes the fix that sets DefaultPermissions.Kill = false during config sanitization when authRequireGuestsToLogin is enabled. As a temporary workaround if immediate patching is not feasible, implement network-level access controls (firewall rules, reverse proxy authentication) to restrict access to the OliveTin RPC/API endpoints to trusted IP ranges only. No configuration-only workaround within OliveTin itself is available for unpatched versions (GitHub Release, GitHub Commit).

The vulnerability was responsibly disclosed by security researcher kule500, who was credited in both the GitHub Security Advisory and the patch commit message. The OliveTin maintainer (jamesread) acknowledged the disclosure positively, thanking the reporter for responsible disclosure in the commit message. The advisory was noted in automated CVE tracking feeds and the openSUSE security announce mailing list, indicating package maintainers are tracking the issue for downstream distributions (GitHub Advisory, GitHub Commit).