https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T02:10:11.335483+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-274830 EUVD-2026-274830 2026-10-07T02:10:11.340798+00:00 EUVD-2026-274830 https://cve.radiocsirt.org/vuln/fkie_cve-2026-28790 fkie_cve-2026-28790 2026-10-07T02:10:11.340840+00:00

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.

 https://cve.radiocsirt.org/vuln/ghsa-4fqm-6fmh-82mq GHSA-4fqm-6fmh-82mq — OliveTin has Unauthenticated Action Termination via KillAction When Guests Must Login 2026-10-07T02:10:11.340876+00:00

Affected: Go: github.com/OliveTin/OliveTin

### Summary

OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. In the tested release (3000.10.2), guests are correctly blocked from dashboard access, but an still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions.

### Details The issue is caused by inconsistent authorization enforcement between dashboard access and action-control RPCs.

KillAction() authenticates the caller and applies only the per-action kill ACL check:

- service/internal/api/api.go:62

However, it does not enforce the guest login requirement. The guest/login gate exists separately in:

- service/internal/api/api.go:474

That gate is used by dashboard-style methods, but not by KillAction.

In addition, when authRequireGuestsToLogin is enabled, config sanitization disables guest view, exec, and logs permissions, but leaves kill unchanged:

- service/internal/config/sanitize.go:160

Specifically:

- DefaultPermissions.View = false - DefaultPermissions.Exec = false - DefaultPermissions.Logs = false - DefaultPermissions.Kill remains unchanged

As a result, in the default configuration path where Kill remains allowed, an unauthenticated guest user can still satisfy IsAllowedKill():

- service/internal/acl/acl.go:133

I validated this behavior on a c…