CVE-2026-67439

Received Received - Intake

Information Disclosure in OliveTin Web Interface

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user with exec permission but logs:false to read action output. This issue is fixed in version 3000.17.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-67439

Affected Vendors & Products

Vendor	Product	Version / Range
olivetin	olivetin	to 3000.17.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

OliveTin before version 3000.17.0 has an issue where the StartActionAndWait and StartActionByGetAndWait endpoints return full command output without checking the logs permission. This allows users with exec permission but restricted logs access to view sensitive output.

Impact Analysis

An attacker with exec permission but no logs access could read command output, potentially exposing sensitive data like passwords, API keys, or internal system information.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) by exposing personal or confidential information.

Mitigation Strategies

Upgrade OliveTin to version 3000.17.0 or later to address the issue where LogEntry output is exposed without proper permission enforcement.

Hi! I’m here to help you understand CVE-2026-67439. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70