CVE-2026-67439: Incorrect Authorization Leading to Log Leak in OliveTin
Vulnerability ID: CVE-2026-67439
CVSS Score: 4.3
Published: 2026-07-30
An incorrect authorization vulnerability (CWE-863) exists in OliveTin prior to version 3000.17.0. The flaw allows authenticated users who are authorized to execute commands but restricted from viewing logs to bypass this restriction. By utilizing synchronous endpoints, attackers can directly access execution outputs containing sensitive system data, credentials, and environmental configurations.
TL;DR
OliveTin failed to validate log-viewing permissions on synchronous execution endpoints, leaking sensitive shell outputs to restricted users.
Technical Details
- CWE ID: CWE-863 (Incorrect Authorization)
- Attack Vector: Network (AV:N)
- Privileges Required: Low (PR:L)
- CVSS v3.1 Score: 4.3 (Medium)
- EPSS Score: 0.00252 (Percentile: 16.75%)
- Exploit Status: None (No public PoC)
- CISA KEV Status: Not Listed
Affected Systems
- OliveTin Core Server
-
OliveTin: >= 3000.7.0, < 3000.17.0 (Fixed in:
3000.17.0)
Code Analysis
Commit: e421780
Fix log ACL bypass in synchronous actions
--- a/service/internal/api/api.go
+++ b/service/internal/api/api.go
@@ -282,6 +282,21 @@ func (api *oliveTinAPI) findBindingByIDOrNotFound(bindingId string) (*executor.A
Mitigation Strategies
- Restrict 'exec' permissions to only fully trusted administrators.
- Audit command outputs to verify no sensitive data is written to standard output or standard error.
- Monitor application log endpoints for anomalous synchronous API calls.
Remediation Steps:
- Upgrade the OliveTin installation to version 3000.17.0 or higher.
- Validate the configurations in /etc/OliveTin/config.yaml for data exposure.
- Restart the OliveTin service to apply configuration and binary upgrades.
References
Read the full report for CVE-2026-67439 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)