CVE-2026-28790
HIGHolivetin < 3000.11.0 - Unauthenticated Denial of Service via KillAction RPC
Title source: llmDescription
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq
Patch x_refsource_misc
https://github.com/OliveTin/OliveTin/commit/d9804182eae43cf49f735e6533ddbe1541c2b9a9
Release Notes x_refsource_misc
https://github.com/OliveTin/OliveTin/releases/tag/3000.11.0
Scores
CVSS v3
7.5
EPSS
0.0065
EPSS Percentile
46.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-284
CWE-863
CWE-862
Status
published
Products (1)
olivetin/olivetin
< 3000.11.0
Published
Mar 05, 2026
Tracked Since
Mar 06, 2026