CVE-2026-67439: OliveTin Information Disclosure Flaw

CVE-2026-67439 Overview

CVE-2026-67439 is an authorization bypass vulnerability in OliveTin, a web-based tool that provides safe access to predefined shell commands. The flaw exists in the StartActionAndWait and StartActionByGetAndWait endpoints within service/internal/api/api.go. These endpoints return the full LogEntry output after execution without enforcing the logs permission. A user granted exec permission but explicitly denied logs access can still read command output through these endpoints. The issue affects OliveTin versions prior to 3000.17.0 and is categorized under [CWE-863: Incorrect Authorization]. Version 3000.17.0 resolves the flaw.

Critical Impact
Authenticated users with execute-only permissions can read sensitive command output that should be restricted, potentially exposing system information, credentials, or file contents returned by predefined actions.

Affected Products

OliveTin versions prior to 3000.17.0
Deployments using role-based permissions with exec:true and logs:false
Self-hosted OliveTin web interface installations

Discovery Timeline

2026-07-29 - CVE-2026-67439 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-67439

Vulnerability Analysis

OliveTin implements a permission model that separates the ability to execute actions from the ability to view their output logs. Administrators can configure users with exec:true and logs:false to allow triggering commands while restricting visibility into their results.

The vulnerability breaks this separation. The StartActionAndWait and StartActionByGetAndWait API endpoints wait for the triggered action to complete and return a LogEntry structure containing the full command output. The handlers verify the caller has execute rights but do not check the logs permission before returning the entry. Any user permitted to invoke these synchronous endpoints receives stdout, stderr, and exit metadata regardless of their log-access setting.

The weakness maps to [CWE-863: Incorrect Authorization]. The authorization decision uses a single permission check when the response requires two.

Root Cause

The handlers in service/internal/api/api.go couple action execution and response construction. The synchronous variants return the complete LogEntry object immediately after the shell command finishes. The code path lacks a conditional that filters or redacts the log payload for callers without the logs permission.

Attack Vector

An authenticated user with execute rights sends a request to StartActionAndWait or StartActionByGetAndWait for any action they can invoke. The server executes the action and responds with the full log entry. The attacker reads output that the administrator intended to hide. Exploitation requires only standard user credentials and no elevated privileges.

See the GitHub Security Advisory GHSA-jm28-2wcr-qf3h for maintainer analysis.

Detection Methods for CVE-2026-67439

Indicators of Compromise

Access log entries showing calls to StartActionAndWait or StartActionByGetAndWait from accounts configured with logs:false
Repeated synchronous action invocations from a single low-privilege account within short time windows
Unexpected use of GET-based action endpoints from browser sessions that normally read the UI

Detection Strategies

Audit OliveTin access logs for API calls to the two affected endpoints and correlate with the caller's configured permission set
Review the OliveTin configuration file for users or roles defined with exec:true and logs:false and flag them as at-risk accounts
Compare returned response sizes for the synchronous endpoints against expected empty or truncated payloads for restricted users

Monitoring Recommendations

Forward OliveTin request logs to a central log store and alert on StartActionAndWait or StartActionByGetAndWait invocations from restricted accounts
Track version strings across OliveTin instances to identify hosts still running builds prior to 3000.17.0
Baseline normal action invocation volume per user and alert on deviations

How to Mitigate CVE-2026-67439

Immediate Actions Required

Upgrade OliveTin to version 3000.17.0 or later using the GitHub Release 3000.17.0
Inventory all OliveTin deployments and identify instances running versions prior to 3000.17.0
Review permission configurations and rotate any credentials or secrets that may have been exposed through action output

Patch Information

The fix is included in OliveTin 3000.17.0. The patch enforces the logs permission before returning LogEntry data from the synchronous action endpoints. Review the GitHub Commit Update for the exact code change.

Workarounds

Remove exec permission from any user or role that must be denied log access until the upgrade is applied
Restrict OliveTin API access to trusted networks using a reverse proxy or firewall rules
Audit action definitions and remove or restrict actions whose output contains sensitive data

bash

# Verify installed OliveTin version and upgrade
olivetin --version

# Docker upgrade example
docker pull olivetin/olivetin:3000.17.0
docker stop olivetin && docker rm olivetin
docker run -d --name olivetin \
  -p 1337:1337 \
  -v /etc/OliveTin:/config \
  olivetin/olivetin:3000.17.0