Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-28790
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): HIGH
Activity log
- Created suggestion
OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.
References
-
https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq x_refsource_CONFIRM
-
https://github.com/OliveTin/OliveTin/releases/tag/3000.11.0 x_refsource_MISC
Affected products
OliveTin
- ==< 3000.11.0
Matching in nixpkgs
pkgs.olivetin
Gives safe and simple access to predefined shell commands from a web interface
-
nixos-unstable 2025.11.25
- nixpkgs-unstable 2025.11.25
- nixos-unstable-small 2025.11.25
-
nixos-25.11 2025.11.25
- nixos-25.11-small 2025.11.25
- nixpkgs-25.11-darwin 2025.11.25
Package maintainers
-
@Defelo Defelo