CVE-2026-67439: OliveTin incorrect authorization in synchronous execution endpoints

Executive brief

OliveTin, a tool for providing a web interface to shell commands, contains a security flaw where users can view the output of commands they run even if they are explicitly denied log access. This could allow an authorized user to see sensitive information, such as passwords or system details, that appear in the command's output. The issue affects specific synchronous execution features and could lead to the exposure of administrative secrets.

Technical details

An authorization bypass exists in OliveTin's synchronous execution RPCs, specifically 'StartActionAndWait' and 'StartActionByGetAndWait'. While OliveTin's ACL model correctly separates 'exec' and 'logs' permissions for most endpoints, these specific handlers return a full 'LogEntry' object containing command output without verifying the 'logs' permission. An attacker with 'exec' but not 'logs' permissions can exploit this to read stdout/stderr, potentially disclosing credentials or sensitive operational data. The vulnerability was addressed in version 3000.17.0 (specifically commit e421780).

Affected products

• OliveTin OliveTin < 0.0.0-20260708085316-e421780c9885

Timeline

• 2026-07-08: patched: Fixed in commit e421780c9885aa5024d2f47b4ed4898f2f18eb90
• 2026-07-29: advisory: NVD publication date
• 2026-07-30: disclosed: GitHub Advisory published

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D