CVE-2026-32102: 
NixOS vulnerability analysis and mitigation

CVE-2026-32102 is an unauthorized action output disclosure vulnerability in OliveTin, a web interface that provides access to predefined shell commands. The flaw allows a low-privileged authenticated user to receive execution events and command output from actions they are not authorized to view by subscribing to the live EventStream. It affects OliveTin version 3000.10.2 and earlier. The vulnerability was published on March 10–11, 2026, with a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is improper access control (CWE-284) and incorrect authorization (CWE-863) in OliveTin's EventStream subscription path. The EventStream() function in service/internal/api/api.go (line 776) only verifies that the caller has dashboard access before registering them as a stream subscriber; it does not enforce per-action ACLs. Subsequent execution callbacks — OnExecutionStarted (line 846), OnExecutionFinished (line 869), and OnOutputChunk (line 1047) — broadcast events including action metadata, tracking IDs, initiating username, live output chunks, and final command output to all connected subscribers without any per-recipient authorization check. By contrast, the standard log APIs (GetLogs, GetActionLogs, isLogEntryAllowed) do apply per-action authorization, making the EventStream path an inconsistent and exploitable bypass (Github Advisory).

Successful exploitation results in a high confidentiality impact with no integrity or availability impact. A low-privileged authenticated user can passively receive sensitive output from privileged shell commands — such as secrets, API tokens, credentials, or internal system details — that they are explicitly not permitted to view. This is particularly damaging in multi-user OliveTin deployments where privileged actions produce sensitive operational output, as the attacker requires no special interaction beyond subscribing to the EventStream (Github Advisory, Red Hat Bugzilla).

A proof-of-concept (PoC) Go test file (event_stream_leak_test.go) is publicly available in the OliveTin security advisory, with step-by-step reproduction instructions targeting version 3000.10.2. The PoC demonstrates that a user with no ACLs (alice) receives the ExecutionFinished event and protected output (e.g., TOPSECRET=alpha-bravo-charlie) from a privileged action executed by an admin. The EPSS score is approximately 0.024% (7th percentile), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (Github Advisory).

1. Obtain low-privileged credentials: Acquire any valid OliveTin account that has dashboard access but lacks ACLs for privileged actions.
2. Connect to the EventStream endpoint: Using a browser, curl, or a custom HTTP client, authenticate and subscribe to the OliveTin live EventStream (e.g., via the dashboard's real-time event feed).
3. Wait for privileged action execution: Remain subscribed while an admin or privileged user triggers a protected action (e.g., a shell command that outputs secrets or tokens).
4. Receive unauthorized output: The OnExecutionStarted, OnExecutionFinished, and OnOutputChunk callbacks broadcast the full event payload — including action metadata, execution tracking IDs, initiating username, live output chunks, and final command output — to all connected subscribers, including the low-privileged attacker, with no per-recipient ACL check.
5. Extract sensitive data: Parse the received EventStream messages to extract secrets, credentials, or other sensitive operational output from the privileged action's output field (Github Advisory).

• Network: Unusual or persistent HTTP connections to the OliveTin EventStream endpoint from low-privileged user accounts; multiple simultaneous EventStream subscriptions from accounts that do not normally use real-time features.
• Logs: OliveTin access logs showing low-privileged users subscribing to the EventStream endpoint (/api/EventStream or equivalent) around the time privileged actions are executed; log entries showing ExecutionFinished or OnOutputChunk events delivered to unauthorized users.
• Behavioral: Low-privileged accounts maintaining long-lived connections to the OliveTin server without performing any actions themselves; accounts with no configured ACLs appearing in EventStream subscriber lists.

The GitHub Advisory notes that version 3000.10.2 is the last affected version, with a patched version listed as 3000.10.2 in the advisory (indicating the fix was applied in a subsequent release after this version). Users should update OliveTin to a version released after 3000.10.2 as soon as a patched release is available. As an interim workaround, administrators should restrict dashboard access to only fully trusted users, enforce network-level controls to limit who can reach the OliveTin interface, and monitor EventStream subscriptions for unauthorized access patterns (Github Advisory, Red Hat Bugzilla).

The vulnerability was reported by security researcher kule500 and published by OliveTin maintainer jamesread via the GitHub Security Advisory program on March 10, 2026. Red Hat tracked the issue via Bugzilla (Bug 2446817) with a high severity rating. No significant broader media coverage or notable social media commentary beyond the advisory itself has been identified at this time (Github Advisory, Red Hat Bugzilla).