CVE-2026-28790

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.65% chance of exploitation in the next 30 days, 49th percentile

Published

2026-03-05

Updated

2026-03-06

Proof-of-concept exploits (1)

• advisories/GHSA-4fqm-6fmh-82mq

References

• CVE Record
• NVD entry

Related

• CVE-2026-28789
• CVE-2026-28791
• CVE-2026-28788
• CVE-2026-28792
• CVE-2026-28787
• CVE-2026-28793