CVE-2026-28790 HIGH

CVE-2026-28790: OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login

Vendor Olivetin
Product OliveTin
Weakness CWE-284
Published March 5, 2026
Last update March 6, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.

Key dates

02Disclosure timeline

March 5, 2026 CVE published
March 6, 2026 Record updated