NIXPKGS-2026-0559
GitHub issue
published on 7 Mar 2026
by @mweinelt Activity log
- Created automatic suggestion
- @mweinelt accepted
- @mweinelt published on GitHub
OliveTin: Unauthenticated Action Termination via KillAction When Guests Must Login
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.0, OliveTin allows an unauthenticated guest to terminate running actions through KillAction even when authRequireGuestsToLogin: true is enabled. Guests are correctly blocked from dashboard access, but can still call the KillAction RPC directly and successfully stop a running action. This is a broken access control issue that causes unauthorized denial of service against legitimate action executions. This issue has been patched in version 3000.11.0.
References
-
https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq x_refsource_CONFIRM
-
https://github.com/OliveTin/OliveTin/releases/tag/3000.11.0 x_refsource_MISC
Affected products
OliveTin
- ==< 3000.11.0
Matching in nixpkgs
pkgs.olivetin
Gives safe and simple access to predefined shell commands from a web interface
-
nixos-unstable 2025.11.25
- nixpkgs-unstable 2025.11.25
- nixos-unstable-small 2025.11.25
-
nixos-25.11 2025.11.25
- nixos-25.11-small 2025.11.25
- nixpkgs-25.11-darwin 2025.11.25
Package maintainers
-
@Defelo Defelo