OliveTin gives access to predefined shell commands from a web interface

CVE-2026-28790 is an authorization gap in OliveTin before 3000.11.0. When authRequireGuestsToLogin: true is enabled, guests are correctly blocked from dashboard access, but the KillAction RPC still accepts unauthenticated guest requests and can terminate a running action if the guest can supply a live executionTrackingId. The fix in commit d980418 closes the gap by also disabling default guest kill permission when guest login is required.

The vendor's HIGH 7.5 is technically understandable from a base-CVSS view—network, no auth, no user interaction, availability impact—but it overstates enterprise urgency. In the real world this only matters on exposed OliveTin instances, only when admins explicitly enabled forced login, only while an action is actively running, and only if the attacker knows or can obtain the live tracking ID. That's disruptive, but it's narrow operational DoS, not broad service compromise.

Why this verdict

• Vendor score assumes worst-case availability impact but the published impact is only unauthorized termination of currently running actions—no RCE, no data theft, no account takeover.
• Attacker position is narrower than CVSS implies: while technically unauthenticated remote, the practical population is only reachable OliveTin instances, which is a niche product with limited enterprise exposure compared with mainstream admin platforms.
• Exploitability depends on runtime conditions: the target must have authRequireGuestsToLogin: true, an action must be actively running, and the attacker must know or obtain the live executionTrackingId.
• Modern controls reduce reachability: VPNs, reverse proxies, internal-only placement, and network ACLs should block the first step in many real deployments.
• Threat intel is quiet: no KEV listing, no public exploitation evidence found, and very low EPSS all argue against treating this like a hot operational emergency.

Why not higher?

If this let unauthenticated users start commands, alter configuration, or read logs, the score would jump immediately. It doesn't. The attacker can only stop a live action, and only after clearing several narrowing prerequisites that most commodity exploitation workflows won't reliably satisfy.

Why not lower?

This still deserves attention because the exploit is simple once the prerequisites line up, and the advisory includes a public PoC. In environments using OliveTin for maintenance, backup, or deployment workflows, killing a running action can have real operational consequences even without code execution.

1. Restrict network reachability — Put OliveTin behind VPN, SSO proxy, source-IP allowlists, or internal-only routing so unauthenticated Internet users never touch the RPC surface. For a MEDIUM verdict there is no noisgate mitigation SLA; do this as standard hardening while you work toward patching within the 365-day remediation window.
2. Block guest access at the reverse proxy — If OliveTin must stay reachable, enforce authentication at the reverse proxy for the entire app path, including RPC endpoints, instead of relying on app-only guest restrictions. Again, no mitigation SLA applies at MEDIUM; implement as a defense-in-depth control on your normal hardening cycle.
3. Watch for guest KillAction usage — Alert on OliveTin or proxy logs where username="guest" or unauthenticated sessions hit KillAction, especially immediately after a StartAction. This is cheap detective coverage and helps validate whether the bug is being poked before you finish remediation.
4. Reduce exposure of tracking identifiers — Avoid predictable or operator-shared tracking IDs in workflows and limit where execution identifiers are exposed in logs, dashboards, or chat integrations. This does not fix the bug, but it increases attacker friction by protecting the key prerequisite.

Run this on the OliveTin host or container host where you can read the OliveTin binary/package metadata and the active config.yaml. Invoke it as bash check_cve_2026_28790.sh /path/to/config.yaml — for example, bash check_cve_2026_28790.sh /etc/OliveTin/config.yaml. Read access to the config file is required; root is only needed if the file or container metadata is restricted.

#!/usr/bin/env bash
# check_cve_2026_28790.sh
# Detect likely exposure to CVE-2026-28790 in OliveTin.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

CONFIG_PATH="${1:-/etc/OliveTin/config.yaml}"
VERSION=""
AUTH_REQ=""

verlte() {
  [ "$1" = "$2" ] && return 0
  [  "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

find_version() {
  if command -v olivetin >/dev/null 2>&1; then
    VERSION=$(olivetin --version 2>/dev/null | grep -Eo '[0-9]{4}\.[0-9]+\.[0-9]+' | head -n1)
    if [ -n "$VERSION" ]; then
      return 0
    fi
  fi

  if command -v docker >/dev/null 2>&1; then
    VERSION=$(docker ps --format '{{.Image}}' 2>/dev/null | grep -Eo 'olivetin[:@][^ ]+' | grep -Eo '[0-9]{4}\.[0-9]+\.[0-9]+' | head -n1)
    if [ -n "$VERSION" ]; then
      return 0
    fi
  fi

  return 1
}

find_auth_setting() {
  if [ -r "$CONFIG_PATH" ]; then
    AUTH_REQ=$(grep -Ei '^[[:space:]]*authRequireGuestsToLogin[[:space:]]*:' "$CONFIG_PATH" | tail -n1 | awk -F: '{gsub(/[[:space:]]/,"",$2); print tolower($2)}')
    return 0
  fi

  if [ -r /config/config.yaml ]; then
    CONFIG_PATH=/config/config.yaml
    AUTH_REQ=$(grep -Ei '^[[:space:]]*authRequireGuestsToLogin[[:space:]]*:' "$CONFIG_PATH" | tail -n1 | awk -F: '{gsub(/[[:space:]]/,"",$2); print tolower($2)}')
    return 0
  fi

  return 1
}

find_version || true
find_auth_setting || true

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - could not determine OliveTin version"
  exit 2
fi

if ! [[ "$VERSION" =~ ^[0-9]{4}\.[0-9]+\.[0-9]+$ ]]; then
  echo "UNKNOWN - unrecognized OliveTin version format: $VERSION"
  exit 2
fi

if verlte "$VERSION" "3000.10.999"; then
  VERSION_VULN=true
else
  VERSION_VULN=false
fi

if [ -z "$AUTH_REQ" ]; then
  echo "UNKNOWN - version=$VERSION but could not read authRequireGuestsToLogin from config"
  exit 2
fi

if [ "$VERSION_VULN" = true ] && [ "$AUTH_REQ" = "true" ]; then
  echo "VULNERABLE - OliveTin $VERSION with authRequireGuestsToLogin=true"
  exit 1
fi

if [ "$VERSION_VULN" = false ]; then
  echo "PATCHED - OliveTin $VERSION is >= 3000.11.0"
  exit 0
fi

if [ "$AUTH_REQ" != "true" ]; then
  echo "PATCHED - OliveTin $VERSION is in vulnerable range, but authRequireGuestsToLogin is not enabled so this CVE path is not exposed"
  exit 0
fi

echo "UNKNOWN - unable to make a final determination"
exit 2

Sources

1. NVD CVE-2026-28790
2. GitHub Advisory GHSA-4fqm-6fmh-82mq
3. OliveTin fix commit d980418
4. OliveTin release 3000.11.0
5. OliveTin configuration docs
6. OliveTin force-login example
7. CISA Known Exploited Vulnerabilities Catalog
8. Go vulnerability report GO-2026-4587