CVE-2026-67439 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

CVE-2026-67439 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

CVE-2026-67439

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

CVE-2026-67439

CVE-2026-67439 affects OliveTin prior to 3000.17.0. The StartActionAndWait and StartActionByGetAndWait endpoints in service/internal/api/api.go return full LogEntry output after execution without enforcing the logs permission, enabling a user with exec permission but logs:false to read action out...

CVE-2026-67439 OliveTin: StartActionAndWait Endpoints Bypass `logs` Permission and Return Action Output

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

CVE-2026-67438

OliveTin versions 3000.2.0 through 3000.17.0 expose a vulnerability where the checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions. This allows values that pass typeSafetyCheckRegex to be interpolated by wrapCommandInShell into an sh -c co...

CVE-2026-67438

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67438 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67438 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67438 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

CVE-2026-67437 OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

CVE-2026-67437

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

CVE-2026-67437 OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

CVE-2026-67437 OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...

CVE-2026-67437

OliveTin: The CVE-2026-67437 issue is in the OAuth2 login path (service/internal/auth/otoauth2/restapi_auth_oauth2.go) where per-login state is stored in an unbounded registeredStates map on every /oauth/login request. This can allow an unauthenticated attacker to exhaust memory and cause a denia...

K000162672: Apache HTTP Server vulnerability CVE-2026-34356

Security Advisory Description Heap-based Buffer Overflow vulnerability in Apache HTTP Server with malicious backend servers and ProxyPassReverseCookie This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue...

Moderate: Red Hat Security Advisory: container-selinux and crun security, bug fix, and enhancement update

An update for multiple packages is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-11331 affecting package bind for versions less than 9.20.26-1

CVE-2026-11331 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-11605 affecting package bind for versions less than 9.20.26-1

CVE-2026-11605 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-13204 affecting package bind for versions less than 9.20.26-1

CVE-2026-13204 affecting package bind for versions less than 9.20.26-1. An upgraded version of the package is available that resolves this issue...