CVE-2026-28790: OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

Vulnerability summary

CVE-2026-28790 is a high (CVSS 7.5) Improper Access Control vulnerability in olivetin. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 54.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 05-03-2026
   PublishedVulnerability first disclosed.
2. 06-03-2026
   Last modifiedVulnerability information updated.

Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.